API Security

Discover and take inventory of all your APIs, both internal and external. Gain visibility into all APIs, including rogue APIs, zombie APIs and shadow APIs.

• Autodiscover APIs

  Automatically detect external, internal and third-party API services in all your cloud-native environments.

• Identify all APIs

  Get a detailed view of exposed APIs — including unknown, shadow and zombie APIs — to understand the attack surface.

• Track observations

  Explore real-time and historical metrics on security coverage, traffic activity, attack types and traffic sources, along with API observations and unprotected web applications discovery.

Identify and stop the attacks that web application firewalls (WAFs) and API gateways miss. Protect APIs in real-time from the OWASP API Security Top 10 risks, as well as advanced DoS threats, bot attacks, file upload attacks and access control issues.

• Secure APIs against Layer 7 attacks

  Simplify enforcement of positive API definitions based on OpenAPI, Swagger file or manual customization.

• Protect APIs against abuse

  Protections cover OWASP API Security Top 10 including SQL injection, cross-site scripting, code injection and more.

• Manage bot risks

  Gain visibility and protection into bad bots, known good bots, headless browsers and other automation frameworks accessing protected web applications and APIs, including static and dynamic detections.

• Stop DoS attacks

  Enforce the rate limit on IPs or sessions to protect against high-rate and "low-and-slow" application-layer DoS attacks.

• Control Access

  Restrict access to your APIs based on geographical locations, IP ranges and client types.

• Enforce secure file uploading policies

  For applications that allow users to upload files, enforce file upload restrictions based on file extension and content.

Gain insights into all API-related risks — and without impacting application performance. Get both visibility and protection with inline and out-of-band deployment options, depending on your application’s requirements.

• Inline agent-based protection

  Get real-time visibility, alerting and protecting against API abuse and web-based attacks.

• Out-of-band visibility

  Utilize full application-layer visibility into APIs and detect and alert against application-layer attacks in near-real time, without applying any latency or risk to the application.

• Auto scale capability

  As your application grows in your deployment, the number of defenders grows, ensuring full and uninterrupted protection of your application.