All APIs must have clearly defined authorization models that control what authenticated consumers can access and perform, using role-based or attribute-based access control to ensure that permissions are granular, auditable, and consistently enforced across all API operations.
API Authorization Is Properly Defined and Enforced
Policies
Authorization
Authorization is where you define what authenticated consumers can actually do. RBAC, ABAC, and permission models determine the boundaries of access, and getting this right is critical.
Authentication
Authentication details should always travel with the API contract. I have seen too many situations where developers can find the docs but have no idea how to actually authenticate. That information...
OAuth (Authentication)
OAuth is the standard I see most often when APIs need proper authorization flows. Having a clear policy around OAuth usage keeps the implementation consistent and reduces security surface area.
JWT (Authentication)
JWT is a common pattern I see across the API landscape for authentication. Having a policy around how JWTs are used keeps things consistent and prevents teams from rolling their own approach.
Keys (Authentication)
API keys are the most basic building block of API authentication. A policy here makes sure keys are handled consistently and not just thrown around without any standards in place.
Scopes (Authentication)
OAuth scopes are where the rubber meets the road on access control. Getting scopes right means consumers understand exactly what they are asking for and what they are getting.
Operation Security
Security definitions on operations make access requirements explicit. Every operation should clearly state what authentication and authorization is required to call it.
OpenAPI Security
Security schemes in OpenAPI define how authentication works at the spec level. This is where API keys, OAuth, and other security patterns become part of the machine-readable contract.
Experiences
Access
I keep seeing teams struggle with getting consumers proper access to their APIs. The sign-up, authentication, and authorization process is where you lose people before they ever make their first AP...
Security
Security is the area where I see the most gap between what teams think they have covered and what's actually happening. The surface area of APIs keeps growing, and most organizations aren't keeping...
Trust
Trust is earned at the API level, and I see it broken constantly. When consumers don't trust that your API will be there tomorrow, behave the same way it did yesterday, and protect their data, they...
Reliability
Reliability is where the rubber meets the road in the API landscape. If your APIs aren't up when consumers need them, and if new versions don't land smoothly, none of the other building blocks matter.
Compliance
Compliance is where the technology, business, and politics of APIs all collide. I see teams struggling to prove their APIs meet regulatory requirements, and without the right governance building bl...