API Security

What it is

API security protects the programmatic interfaces that expose application functionality and data. Because APIs are direct, automated and frequently unauthenticated at the edge, they are a prime target for enumeration, data harvesting and abuse.

Why it matters

Modern breaches disproportionately start at broken APIs. The most common and damaging flaw — broken object-level authorization (BOLA) — lets an attacker access objects they were never authorized to view simply by changing an ID. OWASP’s API Security Top 10 is the authoritative risk checklist.

How it works

• Authentication & authorization: authenticate the caller (see security:authentication-authorization) and authorize every resource access at the object level, not just the endpoint level.
• Input validation: validate types, lengths and schemas to prevent injection and mass-assignment.
• Rate limiting & throttling: per-identity and per-IP limits to stop brute force and scraping.
• Secrets & tokens: never hardcode secrets; use short-lived scoped tokens.

Detection

• Abnormal per-identity request volume or pagination walks across many IDs (BOLA probing).
• Many 401/403s with valid-looking tokens (token theft / replay).
• Unusual data-volume API responses from a single principal.

Mitigation

• Enforce object-level authorization on every read/write; test with horizontal privilege-escalation cases.
• Apply rate limits, authentication, and input validation at the API gateway.
• Audit and version all endpoints; log authorization-denied and data-exposure events.
• Rotate and scope tokens; reject over-broad scopes.

Investigation

Investigate an API-abuse or data-exposure event via gateway/API logs: principal, requested object IDs, response size, and rate-limited events. Connect authorization and authentication logs. Relevant tooling: security-header review on the endpoint responses (guides:tool-headers-guide).