api-security-design
Installation
SKILL.md
API Security Design
Secure API design protects backend services and data from abuse and the OWASP API Security Top 10 risks - broken object-level authorization (BOLA), broken authentication, broken function-level authorization (BFLA), unrestricted resource consumption, server-side request forgery, and more. On Azure, Azure API Management (APIM) is the primary policy enforcement point, paired with WAF, Entra ID, Key Vault, and Defender for APIs.
When to use
Designing or reviewing the security of APIs - especially external-facing, partner-facing, or sensitive-data APIs - before they go live or as part of a recurring design review.
Do not use this skill for:
- General application or web app security (use
security-architecture,threat-modelling) - API runtime detection and posture only (use
defender-for-apis) - Front-end / SPA design (use web app security guidance)