What is API security?
API security is the practice of protecting the interfaces that applications use to exchange data and perform actions.
Simple example
A mobile app uses an API to retrieve customer information. If the API does not check access properly, other records may be exposed.
Why it matters
APIs often handle sensitive data and business logic, making them valuable targets.
Common warning signs
- The activity is unexpected or unusual for the business context.
- The request or system behaviour creates pressure to act quickly.
- Normal approval, verification, or security processes are bypassed.
- There are signs of unauthorised access, data exposure, or system change.
- Staff are unsure whether the request, message, or system behaviour is legitimate.
Cyber Doc view
This term should be understood in business context, not only as a technical issue. Good protection usually combines clear processes, appropriate technical controls, staff awareness, and a calm response plan.
What to do
Proactive steps
- Require strong authentication for APIs.
- Check authorisation on every request.
- Validate input and rate-limit sensitive endpoints.
- Avoid exposing unnecessary data.
- Log API activity and monitor for abuse.
Reactive steps
- Review API logs for unusual access.
- Revoke exposed tokens or keys.
- Patch weak endpoints.
- Limit or disable affected functions during investigation.
- Assess whether data was accessed or changed.
Related terms
- Authentication
- Authorisation
- Broken access control