API security
API security is the protection of application programming interfaces, their functionality, and exposed data from unauthorized access, misuse, alteration, and disruption.
Secure APIs
The discipline of protecting application programming interfaces, including their exposed data, functionality, and access paths, from misuse and attack.
- How it is used
- Guides secure API design, implementation, testing, deployment, and operations across the full development lifecycle.
- How deep it goes
- Explains attack vectors, design flaws, mitigations, testing, architecture, and monitoring, while deferring detailed vulnerability implementation to focused treatments.
- Examples
- Uses SSRF through an avatar URL, SQL injection and oversized pagination requests, account takeover, data breaches, and business-flow abuse.
- What you can do after
- Build it from scratch, secure APIs by design, test vulnerabilities continuously, configure supporting infrastructure, and detect malicious activity.
The Design of Web APIs, Second Edition
API security is the protection of an application programming interface, its operations, and the data and resources it exposes from unauthorized access or harmful use.
- How it is used
- Guides API design toward authorized access, limited exposure, safe behavior, and secure implementation documentation.
- How deep it goes
- Explains call-level transport, consumer authorization, scopes, end-user context, integrity, errors, and OpenAPI documentation.
- Examples
- Uses Shopping API orders, health profiles, workouts, GPS coordinates, scopes, conditional requests, and mutual TLS migration.
- What you can do after
- Apply API security by limiting exposure, defining scopes, documenting controls, securing errors, and reviewing security-breaking modifications.
Read how The Design of Web APIs, Second Edition explains API security →
Automating API Delivery
API security is the protection of information exchanged through APIs and the reduction of risks arising from API vulnerabilities.
- How it is used
- Protects API-exposed information and business assets by bringing security checks into design, delivery, testing, and operation.
- How deep it goes
- Defines vulnerabilities and threat-modeling terms, then outlines design scans, dynamic testing, and runtime monitoring without detailing their implementation.
- Examples
- Uses an intentionally insecure OWASP crAPI OpenAPI definition for design review and a 42Crunch GitHub Action for scored pipeline checks.
- What you can do after
- Apply it via security-focused definition linting and a configurable pipeline gate, while planning separate testing and runtime protection.
Related concepts
- OAuthaddressed by · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- distributed denial of service attackincludes · A distributed denial-of-service attack uses traffic or requests from multiple sources to overwhelm a target and impair its availability or function.
- sensitive data overexposureincludes · Sensitive data overexposure is a security vulnerability in which an API reveals more information, sensitive fields, or callable behavior than a consumer needs or is authorized to access.
- API Security Top 10used by · The API Security Top 10 is an OWASP publication identifying prevalent and critical security risks specific to application programming interfaces.
- vulnerabilityaddresses · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
- threat modelused by · A threat model is a structured analysis or representation of a system’s relevant threats, adversaries, assets, attack paths, assumptions, and possible mitigations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.