API
Simplified
What is API
End User Backend
with Browser Server
• API is a set of routines, protocols, and tools for
building software applications. An API specifies
how software components should interact.
Request
• It is a set of functions and procedures allowing
the creation of applications that access the
features or data of an operating system, API
application, or other service
Response
• It allows independent developers write
programs that use private company’s services
or data
• A good API makes it easier to develop a
program by providing all the building blocks.
Use Cases of API
Solving Problem of Another Ask Another app for Gain Access to feature of
Application interesting information hardware devices
• For instance, New York's • Snapchat uses the phone's
• Uber borrows PayPal’s
subway system has an API camera API to take
Braintree API, a secure
that allows other apps to pictures, while Google
method for processing credit
access its real-time travel Maps uses the phone's
card payments, to allow its
data, such as where trains geo-location API to know
own app to collect payments
are and when the next train where you are located.
from passengers
will arrive
Benefits of API
Enables efficient data sharing: Allows Improved user experience: APIs enable
seamless integration between different seamless integration of various services and
services, like booking a flight through a travel functionalities within applications, providing a
smoother user experience.
app or using social media login on a website
Promotes innovation: Developers can Faster time to market: By using
leverage existing APIs to build new APIs, developers can focus on building core
applications without starting from scratch. functionalities instead of reinventing the
wheel.
.
Improves flexibility and Customization and
scalability: Businesses can expand their personalization: Organizations can tailor their
offerings and reach new audiences by opening services and offerings to specific needs using
APIs.
their APIs to external developers
Common Attack on API
Broken Authentication: Weak authentication mechanisms like stolen credentials or insecure
token management can grant attackers unauthorized access to sensitive data or functionalities
Authorization Issues: Improper access control rules might allow attackers to manipulate data
or perform actions beyond their authorized level
Injection Attacks: Exploiting vulnerabilities in API inputs to inject malicious code, like SQL
injection or command injection, can give attackers unauthorized control over systems.
Data Breaches: APIs can be targeted to steal sensitive information like personal data, financial
records, or intellectual property.
Denial-of-Service (DoS) Attacks: APIs can be flooded with requests to overwhelm and disrupt
services, causing business and financial losses
Reasons for Increased API Attacks
API Proliferation With more APIs being
developed and exposed, the attack
surface expands, providing more entry
points for attackers.
01
Rise of Shadow Misconfigurations:
APIs: 02 04 Accidental
Unauthorized or misconfigurations or
undocumented APIs, known insecure coding practices
as shadow APIs, lack can create exploitable
security controls and vulnerabilities within APIs
become easy targets for 03
exploitation.
Lack of Visibility:
APIs are often complex and
not well monitored, making
it easier for attackers to
operate undetected.
Protecting against API threats
Regularly patch and Validate and sanitize Employ API security
update API software all user inputs tools and best
practices
01 02 03 04 05 06
Implement strong Monitor API activity Limit API access to
authentication and for suspicious authorized users and
authorization behavior application
mechanism
Types of APIs
Representational State
Simple Object Access
Transfer (REST):
Protocol (SOAP):
A software architecture
A protocol and standard for
style consisting of
exchanging information
guidelines and best
between web services in a
practices for creating
structured format
scalable web services
API Formats
Simple Object Access Protocol Representational State Transfer
(SOAP) (REST)
• An architectural style protocol
• XML based message protocol
• Uses only simple hypertext
• Uses SOAP envelope and then
transfer protocol (HTTP)
HTTP (FTP/SMTP) to transfer the
data • Supports many different data
formats like JavaScript Object
• Only supports XML format
Notation (JSON), eXtensible
• Slower performance, scalability Markup Language (XML), and
can be complex and caching is Yet Another Multicolumn Layout
not possible (YAML)
• Used where REST is not • Performance and scalability are
possible, provides WS-* good and uses caching
features
• Widely used