How deeply does Secure APIs cover endpoint-level request metric?

Explains counter instrumentation, periodic metrics, threshold comparison, investigation, and rate-limiting response.

Endpoint-level request metric

An endpoint-level request metric is a quantitative measurement of requests directed to a particular API endpoint over time.

An endpoint-level request metric measures how often clients call a particular API endpoint over time. It reveals repeated-call patterns that a single log event may miss. section 11.6

For example, a counter on GET /books can record each request. Compare the average requests per minute with current activity, investigate unusual spikes, and consider rate limiting when the pattern appears abusive. section 11.6

Detecting endpoint enumeration

Repeated calls to a user-search endpoint can scrape existing users and their details. OpenTelemetry can report a custom list_books metric under the orders_meter scope; a sample value of 2 represents two GET /books requests.

How Secure APIs covers it

liveBook manning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

OpenTelemetryused by · OpenTelemetry is an open, vendor-neutral observability standard and framework for instrumenting software and generating, collecting, and exporting telemetry such as traces, metrics, and logs.
enumeration attackaddresses · An enumeration attack systematically discovers whether accounts, objects, or other records exist by exploiting observable differences in an application's responses.
rate limitconfigures · A rate limit is a bound on the frequency or volume of operations permitted within a defined interval, scope, or concurrency limit.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.