[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573796-105":53,"doc-detail-573796-en":120},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":113,"head_meta":115,"extra_data":117,"updated_unix":119},105,"en","saltsecurity-api-security-best-practices-2021","SaltSecurity - API Security Best Practices - 2021","","Guidance focuses on securing APIs through secure design and development, emphasizing evaluation of business logic and end-to-end API flows to prevent misuse and abuse. It explains how API documentation supports design reviews, security testing, operations, and protection, while also highlighting the risks of documentation neglect and environment drift (API drift). The paper recommends machine-readable documentation formats, schema validation with awareness of limitations, and continuous monitoring or discovery to maintain accurate inventories. It further covers API discovery and cataloging practices needed for compliance, risk, privacy, and security priorities.",{"@graph":63,"@context":112},[64,80,95],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/saltsecurity-api-security-best-practices-2021/573796/",4,{"url":78,"name":59,"@type":81,"author":82,"headline":59,"publisher":85,"fileFormat":88,"inLanguage":57,"description":61,"dateModified":89,"datePublished":89,"encodingFormat":88,"isAccessibleForFree":90,"interactionStatistic":91},"DigitalDocument",{"name":83,"@type":84},"Taylor Morgan","Person",{"url":68,"name":86,"@type":87},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":92,"interactionType":93,"userInteractionCount":4},"InteractionCounter",{"@type":94},"ViewAction",{"@type":96,"mainEntity":97},"FAQPage",[98,104,108],{"name":99,"@type":100,"acceptedAnswer":101},"Why should business logic and end-to-end API flows be included in secure design reviews?","Question",{"text":102,"@type":103},"Secure reviews must assess how functionality can be misused or abused, not only technical interfaces. Vulnerabilities may only become visible once a full system is built and deployed.","Answer",{"name":105,"@type":100,"acceptedAnswer":106},"What are the top recommendations for secure API documentation?",{"text":107,"@type":103},"Use machine formats (e.g., OpenAPI/OAS), repurpose API schema for testing and protection, and maintain a contingency plan for documentation discrepancies and API drift.",{"name":109,"@type":100,"acceptedAnswer":110},"How can organizations address documentation discrepancies and API drift over time?",{"text":111,"@type":103},"Monitor environments and API traffic at runtime or use tooling that can auto-discover APIs, auto-generate schema definitions, and produce an up-to-date API inventory.","https://schema.org",{"og:url":78,"og:type":114,"og:title":59,"og:site_name":86,"og:description":61},"article",{"robots":116,"canonical":78},"index,follow",{"doc_id":118,"site_id":56},573796,1791946385,{"code":4,"msg":5,"data":121},{"doc_id":118,"user_id":122,"nickname":83,"user_avatar":123,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":124,"file_id":125,"file_url":126,"file_type":127,"file_size":128,"view_count":4,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":129,"language":130,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":131,"faqs":132,"seo_title":133,"seo_description":61,"update_tm":119,"read_time":8},1099523885336,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","5. Include business logic in design reviews: when you perform secure design reviews, ensure that you are evaluating business logic and end to end API flows for susceptibility to abuse. When building or integrating APIs, you must also consider how functionality might be misused or abused. Identifying, triaging, mitigating, and remediating vulnerabilities in your own custom APIs is different from patching vulnerabilities in vendor supplied software. Security issues may also only manifest themselves in a complete system after code has been built and deployed, which is where an organization must stress fast detection and response, not just  \npre-deployment analysis.  \nAPI documentation  \nThe top 3 recommendations for secure design and development include:  \n1. Use machine formats like OpenAPI Specification ՄOASՅ  \n2. Repurpose API schema as a basic testing approach and protection approach  \n3. Have a contingency plan for documentation discrepancies and API drift  \nAPI documentation serves a range of security and non-security purposes throughout the API lifecycle. Documentation is useful for the application and API teams that are building or integrating APIs. Adequate documentation also provides benefits to a range of activities including design reviews, security testing, operations, and protection. API documentation should be created in machine formats such as OAS for REST APIs. The machine formats allow for auto-generation of documentation as part of design and mocking, and they are also parsable by other testing and protection tooling. Like all forms of documentation though, teams inevitably neglect to document APIs or new functionality as they iterate. This reality of API documentation process leads to a type of environment drift, or API drift, that leaves massive gaps in your API inventory and security posture.  \nBest practices for API documentation include:  \n1. Use machine formats for documentation: when generating API documentation, opt for machine formats and schema definitions as opposed to traditional documentation or visual diagrams. Most commonly for REST APIs, these machine formats include Swagger or OAS. Depending on your API design, development or publishing tooling, other formats like RAML or API Blueprint may be present. And if you are exploring GraphQL APIs, then also expect to work with GraphQL schema definitions. Traditional documentation can be useful for reviews by a less technical audience, but such forms of documentation are not easily maintained. The API schema definition formats are designed for quick generation of documentation as  \nSalt I API Security Best Practices I 4  \npart of API design and mocking that is also reusable for testing, integration, publishing, and operations.  \n2. Use API schema validators but acknowledge limitations: API schema validators can find common issues related to formatting or overlooked parameters, but they are not a panacea. View them as a type of static analysis, much like linters or quality checkers within IDEs. Schema validators are inherent in tools like Postman and API management ՄAPIMՅ platforms like Apigee, but they can’t find all types of API issues, let alone security issues or logic flaws. Organizations may also opt to trigger schema validation as part of secure build pipelines. These validation tools are only as good as what you document as part of API design and development. Inevitably, you may be lacking schema definitions as your API ecosystem expands to include partner integrations, external API dependencies, and third-party SaaS services.  \n3. Prepare for documentation discrepancies and API drift: organizations of all sizes and across verticals regularly face difficulties with scaling andoperationalizing API design, development and publication. API drift is a typeof environment drift where the current state of APIs in production does not match what is expected or documented. It is an inevitability with development turnover, outsourcing, and acquisition. Even","cbCaivYAcCk5VCPa","https://ap.wps.com/l/cbCaivYAcCk5VCPa","pdf",2503086,32,"English","# API design review and abuse resistance\n## Business logic and end-to-end API flows\n# API documentation for security and operations\n## Machine formats and documentation benefits\n## API drift and documentation gaps\n## Best practices for documentation\n# API discovery and cataloging\n## Discover beyond production and include dependencies\n## Tagging for DevOps workflows\n## Why API inventory matters for compliance and security","[{\"question\":\"Why should business logic and end-to-end API flows be included in secure design reviews?\",\"answer\":\"Secure reviews must assess how functionality can be misused or abused, not only technical interfaces. Vulnerabilities may only become visible once a full system is built and deployed.\"},{\"question\":\"What are the top recommendations for secure API documentation?\",\"answer\":\"Use machine formats (e.g., OpenAPI/OAS), repurpose API schema for testing and protection, and maintain a contingency plan for documentation discrepancies and API drift.\"},{\"question\":\"How can organizations address documentation discrepancies and API drift over time?\",\"answer\":\"Monitor environments and API traffic at runtime or use tooling that can auto-discover APIs, auto-generate schema definitions, and produce an up-to-date API inventory.\"}]","SaltSecurity - API Security Best Practices - 2021 | PDF"]