Security protects API systems and resources from unauthorized discovery, access, misuse, and exploitation. Resource design, method behavior, and representation boundaries can either reduce or expose risk. section 6.2.5 section 7.2
Apply these security rules when designing APIs:
- Use a sufficiently large, unpredictable key space instead of sequential identifiers, reducing the chance that probing discovers existing or misconfigured resources. section 6.2.5
- Choose authorization errors consistently; returning different responses for nonexistent and unauthorized resources can reveal which resources exist. section 7.2
- Separate highly restricted components, such as employee compensation, into a distinct resource or singleton sub-resource rather than exposing them with ordinary profile data. section 12.1.1
Protecting employee data
An employee API can expose nickname, hometown, and telephone number through the ordinary employee resource while keeping compensation behind a separately protected sub-resource. For unauthorized retrieval, a deliberately consistent error policy prevents callers from learning whether a protected record exists. section 12.1.1 section 7.2
