API security protects the data, functionality, and access paths exposed through application programming interfaces. It means designing, building, and operating APIs to prevent unauthorized access, data leaks, exploits, and misuse. The work spans API design, authentication, authorization, input validation, dependencies, observability, network configuration, and database protection. section 1.1 section 1.0
Treat every API input as a possible attack vector: URLs, query and path parameters, headers, and request bodies can carry malicious values. Weak controls can expose data, alter business operations, overload databases, or enable attacks such as SQL injection, server-side request forgery, mass assignment, and broken object-level authorization. section 1.4 section 1.3
Apply API security as a continuous, cross-functional practice:
- Document the API before protecting it; use an existing specification, generate one from code or traffic, and fill gaps through testing. section 1.2.1
- Model threats during design, constrain inputs, expose safe user flows, separate read-only and write properties, and avoid unnecessary server-side data exposure. section 1.5 section 6.0
- Implement robust authentication and authorization, validate tokens and permissions, and apply suitable controls to users, roles, resources, and operations. section 7.0
- Test continuously with fuzzing, end-to-end checks, and security tests; operate with detailed logs, user-activity monitoring, and visibility into errors and flows. section 1.5 section 1.8
- Secure the surrounding architecture with network segmentation, API gateways, strict firewall policies, safe configuration, and managed attack-surface visibility. section 1.1 section 1.8
A vulnerable pagination endpoint
Consider GET /products?filter=' OR 1=1;--&per_page=100000000. Passing the filter directly into a database query can disclose data or bypass object-level authorization, while the enormous page size can overwhelm the database. Constrain pagination values, validate filters, and parameterize database queries instead of trusting request input. section 1.4 section 1.8
Figure 1.1 API security includes everything that can compromise the security of our APIs, including design, implementation, architecture, and infrastructure. Every element plays a role in keeping our APIs safe and secure.
Use the security mental model to inspect design, implementation, architecture, and infrastructure together rather than treating API security as a single code-level control. section 1.1
