API Security
The practices and technologies used to protect Application Programming Interfaces (APIs) from malicious attacks, unauthorized access, and data exposure, encompassing authentication, authorization, rate limiting, input validation, and monitoring of API traffic.
API security has become a critical concern as modern applications increasingly rely on APIs for inter-service communication, third-party integrations, and mobile application backends. APIs expose application logic and data through programmatic interfaces, and they are frequently targeted by attackers because they provide direct access to backend systems and data. The OWASP API Security Top 10 identifies common API vulnerabilities including broken object-level authorization (BOLA), broken authentication, excessive data exposure, lack of rate limiting, broken function-level authorization, mass assignment, security misconfiguration, injection, improper asset management, and insufficient logging and monitoring.
While no compliance framework specifically mandates 'API security' as a named control, the requirements that apply to application security broadly encompass APIs. ISO 27001 Annex A controls on secure development (A.8.25-A.8.31) apply to API design and implementation. SOC 2 requirements for logical access controls, encryption, and change management directly apply to APIs that handle sensitive data. GDPR's requirement for appropriate technical measures to protect personal data extends to APIs that process or transmit personal information. NIS2's requirements for secure system development and maintenance apply to APIs as critical components of network and information systems. In technology due diligence, API security architecture is a key focus area, particularly for SaaS platforms where APIs are the primary interface.
Comprehensive API security requires multiple layers of protection. Authentication mechanisms (OAuth 2.0, API keys, mutual TLS) verify the identity of API consumers. Authorization controls ensure that authenticated consumers can only access resources they are permitted to use. Input validation prevents injection attacks and ensures data integrity. Rate limiting and throttling prevent abuse and denial-of-service attacks. Encryption (TLS) protects data in transit. API gateways centralize security controls and provide consistent enforcement across APIs. Logging and monitoring of API traffic enable detection of anomalous patterns and potential attacks. Organizations should maintain an API inventory to prevent shadow APIs, implement API versioning and deprecation strategies, conduct regular API security assessments, and include APIs in their vulnerability management and penetration testing programs.
Related frameworks
Related terms
Access Control
The set of policies, procedures, and technical mechanisms that govern who can access which information assets, systems, and resources. Access control ensures that only authorized individuals can view, modify, or interact with sensitive data and systems.
Encryption
The process of converting data into an encoded format that can only be read by authorized parties who possess the correct decryption key. Encryption protects data confidentiality both at rest (stored data) and in transit (data being transmitted over networks).
Identity and Access Management
The framework of policies, processes, and technologies that manages digital identities and controls user access to critical systems and data. IAM encompasses identity lifecycle management, authentication, authorization, single sign-on, directory services, and privileged access management.
Penetration Testing
A simulated cyberattack performed by security professionals to identify vulnerabilities in an organization's systems, networks, and applications. Penetration tests go beyond automated scanning by using the techniques and methodologies that real attackers employ.
Secure Software Development
A methodology that integrates security practices throughout the entire software development lifecycle (SDLC), from requirements and design through coding, testing, deployment, and maintenance, ensuring that security is built into applications rather than added afterward.
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment