Zero-trust networking removes implicit trust from an API system: deny access by default, validate every request and data flow, and authorize only what the requester is allowed to use. Network location or an API’s assumed origin does not make traffic trustworthy. section 3.2 section 3.7
Trust is a vulnerability because applications combine user input, third-party APIs, internal services, databases, and messaging systems. An internal API can still be exposed through deployment or network mistakes, abused by insiders, or accessed by overprivileged users. section 3.2 section 3.4
Apply the model across the API and its surrounding systems:
- Treat every data source and endpoint as a resource requiring protection. section 3.2
- Validate traffic and data regardless of origin, including requests, responses, third-party APIs, internal services, and database flows. section 3.2 section 3.7
- Enforce authentication, authorization, and least privilege so users reach only resources they own or are authorized to inspect or manipulate. section 3.2
- Use dynamic policies, monitor resource integrity, and restrict compromised resources. section 3.2
- Monitor traffic and evaluate the system’s security posture for suspicious activity. section 3.2
Catalog access versus product changes
An unauthenticated e-commerce user may browse the product catalog, but cannot upload products or change their details. The distinction comes from explicit access controls rather than from trusting the user or the network. section 3.2
Build zero-trust controls into design, implementation, testing, and operations. Use secure API frameworks, validate and sanitize incoming and outgoing data, transfer only required fields through DTOs, parameterize database queries, and test implementations against their specifications with fuzz testers such as Schemathesis or RESTler. section 1.2.2 section 1.5
Figure 3.8 Zero-trust APIs apply NIST 800-207’s principles to protect all assets and endpoints, apply robust access controls, and validate data across all flows while actively monitoring malicious activity.
Use the figure to trace how zero-trust APIs protect assets and endpoints, validate data across flows, apply access controls, and monitor malicious activity. section 3.2
