API Security

Secure the API as a set of business operations and data boundaries, not only endpoints. Confirm the actual protocol, identity provider, clients, trust zones, and deployment before selecting controls.

Workflow

1. Inventory hosts, versions, routes/operations, methods, schemas, clients, owners, and data classifications.
2. Map authentication and authorization from actor to object, function, and returned properties.
3. Validate request parsing, content types, size, recursion/depth, and response serialization.
4. Trace outbound URLs, webhooks, redirects, file fetches, and internal network reachability.
5. Model abuse: enumeration, scraping, credential stuffing, expensive operations, workflow bypass, and resource exhaustion.
6. Review token/key lifecycle, storage, audience/issuer, rotation, revocation, and logging.
7. Verify findings with designated test identities and synthetic data.
8. Add regression tests, telemetry, and incident/recovery controls.

Control Checklist