Security API Security

Purpose

Design comprehensive API security controls covering OWASP API Top 10 threat modeling, authentication (JWT, OAuth2, API keys), rate limiting (token bucket, sliding window, per-user/per-endpoint), input validation (JSON schema, allowlist), WAF rules (ModSecurity CRS), request signing, and audit logging.

Agent Protocol

Trigger

Exact user phrases: "API security", "OWASP API Top 10", "rate limiting", "API auth", "JWT security", "OAuth2", "API gateway", "WAF", "API abuse", "API threat modeling", "API protection", "API authentication", "API authorization", "API keys", "OAuth2 API", "API gateway config", "request signing", "API audit", "GraphQL security".