API security

The API Security module provides the features described in the following table.

Click the following questions to learn more about the capabilities of API Security:

• How does API Security classify the business purpose of an API?

  • Login and authentication

  • Mobile verification code authentication

  • Data saving

  • Data query

  • Data export

  • Data sharing

  • Data update

  • Data deletion

  • Data addition

  • Decommission or deactivation

  • Information sending

  • Information verification

  • Email sending

  • Email verification code authentication

  • Account and password authentication

  • Account registration

• What types of sensitive data can API Security detect?

  Sensitivity level	Sensitive data type
  Non-sensitive data (N)	Not applicable.
  Critical sensitivity (L0)	Same as Level 1 (L1) or Level 2 (L2) sensitive data. The sensitivity level is upgraded to Critical (L0) if a single response contains a large amount of Level 1 (L1) sensitive data. The sensitivity level is upgraded to Level 1 (L1) or Critical (L0) if a single response contains a large amount of Level 2 (L2) sensitive data.
  Level 1 sensitivity (L1)	ID card, debit card, mobile number, passport number, Exit-Entry Permit for Hong Kong and Macao, license plate number, military officer ID, Hong Kong ID card, Malaysian ID card, Singaporean ID card, credit card, SSN, JDBC connection string, PEM certificate, KEY private key, Linux passwd file, Linux shadow file.
  Level 2 sensitivity (L2)	Name (Simplified Chinese), address (Chinese mainland), email address, phone number (Chinese mainland), name (Traditional Chinese), name (English), U.S. phone number, religious belief, IP address, MAC address, IPv6 address, GPS location, IMEI, business license number, tax registration number, organization code, unified social credit code, vehicle identification number (VIN).
  Level 3 sensitivity (L3)	Gender, ethnicity, province (Chinese mainland), city (Chinese mainland), unverified ID card number, Swift code, date, URL.

• What types of API risks can API Security detect?

  Risk type	Description
  Suspected exposure of an internal API	An internal API, such as one for internal office, development, testing, or operational management, is exposed on the internet.
  Missing rate-limiting mechanism	The API lacks a security mechanism to handle high-frequency access, making it vulnerable to brute-force attacks and malicious web scraping.
  Excessive sensitive data exposure	The API exposes an excessive amount of sensitive data, which may lead to large-scale data breaches.
  Missing exception handling mechanism	Program error messages are detected, which may indicate risks such as SQL injection or the leakage of application configuration.
  Missing access control mechanism	The API lacks a mechanism to control access that deviates from the established baseline, such as access from unusual regions.
  Sensitive data API lacks authentication	The API lacks an authentication mechanism, allowing unauthorized visitors to access it and obtain sensitive data.

• What types of abnormal events can API Security detect?

  Event type	Description
  API calls from an unusual location	For example, if an API is typically accessed from Beijing, a call from the United States would be considered unusual.
  API calls from an unusual source IP address	For example, if an API is typically accessed from IP addresses in the 192.0.XX.XX range, a call from 192.1.XX.XX would be considered unusual.
  API calls from an unusual client	For example, if an API is typically accessed from a web browser, a call from a Python script would be considered unusual.
  API calls during an unusual time period	For example, if an API is typically active between 09:00 and 17:00, a call at 03:00 would be considered unusual.
  Brute-force attack against a login API	An attacker is attempting to guess account credentials through a brute-force attack.
  Credential stuffing attack against a login API	An attacker is attempting to log in with a large number of stolen credentials.
  Unauthorized access to sensitive information	A caller accesses an API and obtains sensitive data without authorization.
  Excessive retrieval of sensitive data	A caller retrieved an unusually large amount of sensitive data from the API.
  Unusual bulk registration behavior	A large number of accounts have been registered through the API, suggesting spam registrations.
  Unusual bulk export behavior	A large number of file downloads or exports have occurred through the API.
  Unusually high-frequency access	The API is being called at a much higher frequency than normal.
  Verification code brute-force attack	A brute-force attack against verification codes is detected on the API.
  SMS API resource abuse	The SMS sending API is called at a high frequency, which maliciously consumes SMS resources.
  Email API resource abuse	The email sending API is called at a high frequency, suggesting a potential email bomb attack.
  Iterative data scraping from an API	A client scrapes the API at a high frequency, iterating through a specific parameter to retrieve data.
  Non-compliant API call	A parameter in a request does not comply with the API specification. For example, if parameter A is expected to be an integer, but a request uses a string for parameter A.