> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/dynamic-testing-and-api-security/api-security.md).

# API Security

API Security protects the APIs that serve as the backbone of modern application communication — ensuring that service-to-service interactions, external integrations, and user-facing endpoints are secured against unauthorized access, data leakage, injection attacks, and abuse.

APIs are a major attack surface in microservices architectures. A single misconfigured or unprotected API endpoint can expose sensitive business logic, user data, or internal services.

## **Why API Security Is Used in OpsMx**

OpsMx uses API Security in Delivery Shield to:

* **Discover shadow and unmanaged APIs** — identifying endpoints that were never formally documented or secured
* **Enforce authentication and authorization** — validating OAuth, JWT, and API key controls on every endpoint
* **Detect input validation failures** — preventing injection attacks via malformed or malicious API inputs
* **Protect against data exposure** — identifying APIs that return more data than the caller is entitled to
* **Test GraphQL, REST, and SOAP APIs** — imported via OpenAPI/Swagger, WSDL, or GraphQL introspection

### **Key Aspects**

| Control                               | Description                                                       |
| ------------------------------------- | ----------------------------------------------------------------- |
| **Authentication & Authorization**    | OAuth 2.0, JWT validation, API key enforcement                    |
| **Schema Validation**                 | Prevents malformed or malicious inputs at the API boundary        |
| **Rate Limiting & Abuse Protection**  | Detects and blocks API abuse patterns                             |
| **Sensitive Data Exposure Detection** | Flags APIs returning PII, credentials, or sensitive business data |
| **API Inventory & Discovery**         | Tracks all known and shadow API endpoints across the environment  |