All data exposed through APIs must be classified by sensitivity level, with appropriate protections applied based on classification, ensuring that PII, financial data, and other sensitive information is properly handled, encrypted, and only accessible to authorized consumers.
API Data Is Classified and Protected
Policies
Data Classification
Data classification is about knowing what you are exposing through your APIs. PII, financial data, internal data -- each has different handling requirements, and the classification drives those dec...
Transport Security
Transport security is non-negotiable. All API communication should happen over TLS with proper versions and cipher suites. This is the baseline for protecting data in transit.
Input Validation
Input validation is your first line of defense. Checking every parameter, header, and payload for type, format, and range prevents injection attacks and data corruption before they start.
CORS
CORS policies control which origins can access your APIs from web browsers. Getting this wrong either blocks legitimate consumers or opens your APIs up to unauthorized cross-origin requests.
Privacy Policy
A privacy policy covering producers, consumers, and end-users is a legal building block that developers need to see before putting an API to work in their applications. It builds trust and covers l...
OWASP
The OWASP API Security Top Ten is a checklist I look for across the API landscape. Applying it is not optional -- it is the minimum bar for taking API security seriously.
Experiences
Security
Security is the area where I see the most gap between what teams think they have covered and what's actually happening. The surface area of APIs keeps growing, and most organizations aren't keeping...
Trust
Trust is earned at the API level, and I see it broken constantly. When consumers don't trust that your API will be there tomorrow, behave the same way it did yesterday, and protect their data, they...
Compliance
Compliance is where the technology, business, and politics of APIs all collide. I see teams struggling to prove their APIs meet regulatory requirements, and without the right governance building bl...
Legal
The legal side of APIs is something most teams ignore until it bites them. Terms of service, privacy policies, licensing -- these building blocks matter, and the politics around API usage are only ...