About API Security

Reading time: About 5 minutes

API Security builds a closed loop of Discover → Define → Protect, verifying that API requests reaching your hostname comply with the API specifications you declare (request method, authentication, parameters, and request body). Non-compliant requests are handled according to the configured action. API Security and WAF serve complementary roles, so it is recommended to enable both.

Why Dedicated API Security Is Needed

APIs have become the cornerstone of software development, but their openness and ease of access bring security threats that generic WAF rules cannot fully cover:

• Parameter abuse: Sending parameter values that fall outside the declared range or are of the wrong type, or iterating through valid parameter values to guess sensitive data
• Unauthorized access: Accessing API endpoints without valid authentication credentials
• Business logic abuse: Exploiting business logic vulnerabilities in APIs (such as exceeding limits or bypassing checks)
• Uncontrolled API exposure: Not knowing which APIs are actually exposed, leaving shadow APIs in place

How API Security Works

API Security builds a closed loop through a three-step process: Discover → Define → Protect.

Step 1: API Discovery

Based on the API identification model defined by the platform, API Security dynamically inspects real traffic and automatically discovers and aggregates API assets and extracts interface patterns. This helps you organize your asset inventory and discover shadow APIs, solving the problem of “not knowing how many APIs you have.”

Step 2: API Definition

Create, name, and group your APIs, and define the following for each API:

• Valid request paths and HTTP methods
• Allowed request parameters (name, type, value range, and whether required)
• Authentication requirements (no authentication or key-pair authentication)
• Request body structure

The system also supports bulk import based on the platform-provided API Definition Configuration Template (an Excel file) to complete API definition automatically.

Step 3: API Protection

Based on the defined API characteristics, API Security inspects real-time traffic against each defined criterion:

• Request method checks: Verify that the request method falls within the range allowed by the API definition
• Authentication checks: Verify that requests carry valid authentication credentials
• Parameter compliance checks: Verify that parameters match the declared type, value range, and required status
• Body compliance checks: Verify that the request body structure conforms to the API definition

Non-compliant requests are handled according to the configured action (Log or Deny).

Boundary: API Security uses a positive security model and validates only defined API endpoints. Requests to endpoints not defined in API assets pass through without inspection. Therefore, fully defining your API assets is a prerequisite for effective protection.

Detection Modes

Relationship with WAF

WAF blocks common web attack payloads, while API Security verifies whether requests conform to the API definition specification. The two serve different purposes, so it is recommended to enable both for complementary coverage.