What Is API Security?

Why APIs Are Uniquely Vulnerable

APIs expose application functionality and data through defined interfaces designed to be accessible — to partners, mobile apps, and third-party integrations. Unlike web applications where functionality is accessed through a browser interface that provides some natural friction, APIs are designed for direct programmatic access, making them efficient channels for both legitimate use and abuse.

OWASP API Security Top 10

Broken Object Level Authorization — BOLA — is the most critical API vulnerability class. It occurs when an API endpoint returns data based on a user-supplied identifier without verifying that the requesting user is authorized to access that specific object. An API endpoint that returns user profile data for whatever user ID is provided in the request, without checking whether the requester is authorized to view that profile, has BOLA. By simply incrementing or modifying user IDs, an attacker can access any user's data. BOLA enabled the 2022 Optus breach, exposing 9.8 million Australian customer records.

Broken Authentication allows unauthenticated access to functionality that should require valid credentials. Excessive Data Exposure returns more data than the requesting application needs. Mass Assignment allows attackers to set fields they should not be able to modify.

API Security Controls

API gateways provide centralized authentication enforcement, rate limiting, input validation, and logging for API traffic. Deploying an API gateway as the single entry point for all API traffic ensures authentication is enforced consistently rather than relying on individual API implementations. Rate limiting prevents abuse through high-volume automated requests. Input validation blocks malformed requests before they reach backend services.

API inventory management — knowing what APIs exist and what they expose — is the foundational challenge. Shadow APIs, deprecated APIs, and undocumented internal APIs all create exposure that cannot be assessed or protected if they are not known. API discovery tools scan network traffic and application configurations to build comprehensive API inventories.

API Security for PE Portfolio Companies

PE-backed technology companies with significant API exposure should evaluate: Is there an API inventory documenting all internal and external APIs? Are all API endpoints authenticated, and is authentication enforced at the gateway level? Is authorization validated at the object level for every data access, not just at the endpoint level? Is API traffic logged and monitored for anomalous access patterns? Has API security testing been conducted, including testing for BOLA and other OWASP API Top 10 vulnerabilities?

Related Reading

• What is Security by Design?
• What is Cross-Site Scripting (XSS)?

What is API security?

API security is the practice of protecting application programming interfaces from misuse, attack, and unauthorized access. As APIs have become the primary backbone of modern applications including mobile apps, single-page applications, microservices, and integrations, they have also become the primary attack surface. API security combines authentication, authorization, input validation, rate limiting, monitoring, and discovery of shadow APIs that exist outside formal documentation.

How does API security differ from traditional web application security?

Traditional web security focused on browsers rendering HTML with server-side processing. API security addresses programmatic interfaces typically consumed by mobile apps, SPAs, or other services. APIs expose business logic directly and frequently have weaker authentication and authorization than UIs assume. The OWASP API Security Top 10 specifically catalogs API-class vulnerabilities including Broken Object Level Authorization, Excessive Data Exposure, and Mass Assignment that have different attack patterns than traditional web app flaws.

What are the most common API security vulnerabilities?

Broken Object Level Authorization where the API trusts the client to specify which object to access. Broken Authentication including weak JWT implementations and missing rate limits on authentication endpoints. Excessive Data Exposure where APIs return more data than the UI displays. Lack of Resources and Rate Limiting enabling abuse and denial of service. Mass Assignment when clients can set fields they should not control. Improper Asset Management around versioning and shadow APIs.

What tools and platforms support API security?

Specialized API security platforms including Salt Security, Noname Security, Traceable, and Wallarm provide discovery, behavior monitoring, and runtime protection. API gateways like Kong, Apigee, AWS API Gateway, and Azure API Management enforce policy and authentication. DAST tools including Burp Suite Pro, Postman, and StackHawk test APIs during development. SAST tools find vulnerabilities in API code. WAFs and bot management platforms protect against abuse at runtime.

How do organizations build an API security program?

Programs start with API discovery to inventory both documented and undocumented APIs, often surfacing 30 to 50 percent more APIs than security teams expected. Authentication and authorization are standardized using OAuth 2.0, OpenID Connect, and consistent JWT validation. Rate limiting and bot management protect against abuse. Schema validation enforces input contracts. Monitoring detects anomalous API behavior. Specifications like OpenAPI document the intended contracts and drive automated security testing.

What does API security cost?

Specialized API security platforms typically run $50,000 to $500,000 annually depending on API volume and capabilities. API gateways add infrastructure cost ranging from open-source to enterprise pricing. The bigger investment is engineering effort: implementing consistent authentication, designing authorization correctly, and integrating security into the API development lifecycle. Organizations underestimate this cost and assume buying a tool will solve a problem that is fundamentally a development practice issue.

What is the first step in API security?

Conduct API discovery to inventory what APIs actually exist in your environment. Most organizations discover undocumented APIs, deprecated versions still serving traffic, and integrations whose security posture nobody owns. That inventory is the foundation; you cannot secure what you do not know exists. Prioritize the highest-traffic and highest-sensitivity APIs for initial security review.

Real-World Example: Optus Breach 2022 — BOLA at Scale

The 2022 Optus data breach exposed the personal data of 9.8 million Australians through a BOLA vulnerability in a publicly accessible API. The API required no authentication and returned customer records when queried with sequential customer ID numbers. The attacker simply iterated through customer IDs, collecting records until the breach was detected. The API had been exposed to the public internet without authentication as part of a migration, representing a catastrophic API governance failure.

Related Breach Analysis

API failures have produced two of the most consequential exposures in the Cloudskope breach library. Both confirm that API governance — not perimeter security — is now the dominant attack surface for application breaches.

• T-Mobile Data Breach: 9 Breaches, $531M in Penalties — the January 2023 incident exfiltrated 37 million customer records over six weeks through an unauthenticated API endpoint with no rate limiting. The FCC's 2024 settlement specifically cited inadequate API security as a structural failure.
• Facebook-Cambridge Analytica: 87 Million Profiles, $5.7B in Penalties — the foundational case for treating permitted-but-uncontrolled API access as a category of breach equivalent to technical compromise.