Applications & Data · APIs & Integration
APIs
Programmatic interfaces that let systems exchange data and invoke functions across boundaries, and the main integration surface of modern IT.
IntermediateUpdated 2026-09-01
Overview
Most enterprise integration is now HTTP APIs, REST, and increasingly GraphQL and gRPC, authenticated with OAuth 2.0 tokens. Every SaaS platform, cloud service and management tool exposes one, which makes API governance an IT concern rather than only a developer one.
APIs are also a significant attack surface. Broken authorisation, excessive data exposure and unauthenticated internal endpoints are consistently the most common API weaknesses found in practice.
How it works
- 01A gateway sits in front of backend services providing authentication, rate limiting, quota, transformation, caching and logging in one place.
- 02Access tokens carry scopes or roles; the resource server validates signature, issuer, audience and expiry before authorising the specific operation on the specific object.
- 03Versioning and deprecation policy allow change without breaking consumers, and should be published alongside the API.
- 04Webhooks invert the direction, so receiving endpoints must verify signatures and tolerate retries and duplicates.
Security considerations
- Enforce object level authorisation on every request; never rely on unguessable identifiers.
- Return only the fields the consumer needs, and log access to sensitive endpoints.
- Rate limit and quota by client identity, and monitor for enumeration patterns.
- Maintain an inventory of internal and partner APIs, undocumented endpoints are where breaches happen.
Common misconfigurations
- Internal APIs assumed unreachable because they are 'behind the firewall'.
- Long lived API keys shared across environments and embedded in scripts.
- Verbose error messages exposing stack traces and schema details.