Configure API Security Policies
最終更新日：2026-08-27 18:12:03
Reading time: About 6 minutes
Prerequisites: The hostname has been onboarded to this product, and API assets have been defined (the API paths to protect have been entered in the API Inventory menu)
API Security policies check each request against the defined API endpoints and identify requests that do not conform to the API specification, handling them according to the configured action. Inspection is completed at the edge node and adds no load to the origin server.
Configuration is a two-step process: first define the API endpoints in API Inventory, then set the action for each API on the API Security page.
Step 1: Define API Assets
Go to API Inventory (top-level menu) to create endpoint definitions, using one of three methods:
| Method | Description | Use when |
|---|---|---|
| Manual definition | Enter the API path, HTTP methods, parameter names, and types one by one | Few endpoints, with complete documentation |
| Template import | Download the platform-provided API Definition Configuration Template (Excel), fill it in, and upload it to create endpoints in bulk (recommended) | Many endpoints that need to be entered in bulk |
| API Discovery | Enable traffic learning, and the system automatically discovers endpoints from real traffic | Many endpoints without complete documentation |
If you have many endpoints, use template import to create them in bulk and avoid missing any during manual entry.
When defining an endpoint, declare the following elements, which become the checks applied to each request:
| Detection Item | Description | Example |
|---|---|---|
| Request method check | Whether the request method is within the range allowed for the endpoint | A read-only endpoint receives a POST request |
| Authentication check | Whether the request carries valid authentication credentials | Missing key or signature verification failure |
| Parameter compliance check | Whether parameter names, types, values, and required status match the declaration | An integer parameter receives the string "abc" |
| Request body compliance check | Whether the request body’s Content-Type, structure, and fields match the declaration | A POST body carries an undeclared field |
Also choose the detection mode:
| Mode | Description | Use when |
|---|---|---|
| Loose mode | Validates only the defined parameters; undeclared parameters are allowed | Early onboarding, when the endpoint definition is incomplete |
| Strict mode | Validates all parameters on an allowlist basis; undeclared parameters are treated as violations | The endpoint definition is complete and high-security protection is required |
Important: Strict checks such as undeclared parameters take effect only in strict mode. Strict mode places high demands on the completeness of the endpoint definition. If any legitimate parameter is missing from the definition, normal business requests may be blocked by mistake.
Step 2: Choose the Action
Go to the API Security configuration page: Security Settings > Policies > [Target Hostname] > API Security, and set the action for each API:
| Action | Description |
|---|---|
| Not Used | Detection is not enabled for the endpoint (the default action after creating an API) |
| Log | Records logs but does not block, for early observation after launch |
| Deny | Blocks non-compliant requests |
Recommended flow:
- Set the action to Log in the early stage after launch and observe for 3–7 days
- Check API Security hits in Attack Logs to confirm that the endpoint definition has no omissions and no false blocks
- After confirmation, switch the action to Deny
Why observe for 3–7 days instead of a shorter period?
This covers a full business cycle (weekdays and weekends). Different time periods show different legitimate traffic patterns. Observing for only one day may miss legitimate requests that appear only at specific times.
FAQ
Q: Does API Security affect the performance of normal requests?
A: API Security inspection is completed at the edge node and adds very little latency to requests (about 1–2 ms; subject to actual measurement).
Q: My endpoints have no existing specification documents. How do I use API Security?
A: Use the API Discovery (traffic learning) feature to extract the endpoint structure from actual requests and confirm it manually; alternatively, download the platform-provided API Definition Configuration Template (Excel), fill it in manually, and import it in bulk.
Q: What happens to requests for endpoints not defined in API assets?
A: They pass through without API Security inspection. If you want such endpoints to be protected, first add them to assets in API Discovery and complete the definition.