An internal API is intended for employees, internal services, or private infrastructure rather than public users. It commonly automates back-office work such as staff and payroll management, sales forecasting, project management, customer management, and inventory operations. Because these APIs handle sensitive employee, customer, and business data, they often run in private networks—but private placement does not make them trustworthy by default. section 3.4
Treat every internal API as though it were public. Internal APIs are often given less design attention, documentation, authorization, and access control than public APIs. A deployment or network-configuration mistake can expose them externally, while excessive data exposure or leaked credentials can turn that mistake into a breach. section 3.4 section 5.4
A private endpoint becomes a public incident
An internal customer-identity API created for two-factor authentication was expected to run only inside a private network. If deployment or configuration exposes such an endpoint publicly, attackers may reach sensitive operations that were protected only by network location. A similar misconfiguration can expose employee information, credentials, or other confidential business data. section 3.4 section 5.4
Protect internal APIs with layered controls:
- Require authentication, authorization checks, and appropriate access controls on every API call. section 3.4 section 5.4
- Deploy internal endpoints in private subnets so external access is disabled by design. section 9.2
- Use a hardened bastion server when controlled external access to private APIs is necessary. section 9.2
- Expose only documented and tested endpoints through an API gateway, and keep development or internal endpoints inaccessible to the internet. section 9.2
- Check deployments for public-network exposure, leaked secrets, debug responses, excessive data, and missing authorization. section 5.4
Figure 9.11 A bastion server gives us access to an internal network. We use bastion servers to access internal or private APIs and databases. The bastion server sits in the DMZ and is hardened to allow traffic only from certain origins.
Use the network diagram to see how a hardened bastion server in the DMZ controls access to internal APIs and databases. section 9.2
