API Security Section
Last updated
Was this helpful?
Last updated
Was this helpful?
The API Security Section in the Prophaze dashboard provides a detailed view of your application’s API endpoints, their activity, and security status. This section is designed to help you secure your APIs, monitor traffic, and analyze potential threats in real-time.
Total API Endpoints: Displays the total number of APIs being monitored, such as "16 endpoints."
Total API Requests: Tracks the total number of API requests processed in the last 24 hours, for example, "2 requests."
Purpose The Endpoint List provides a comprehensive, detailed table of all detected API endpoints and their configurations. This feature allows you to view key information for each endpoint, enabling easier management and security of your APIs.
For each endpoint, the following details are available:
Method: The HTTP method used for the API request, such as GET, POST, PUT, DELETE, etc.
URI: The API path that defines the resource, for example, /api/v3/user, /api/v3/pet/findByStatus.
Action: Available options to configure, monitor, or secure the endpoint. These actions let you manage and protect each API endpoint as necessary.
Example Endpoints:
DELETE /api/v3/user/ww
Purpose: Deletes a user with the identifier "ww."
Action: Typically configured for deletion operations. You can monitor and apply security measures to prevent unauthorized access or accidental deletions.
GET /api/v3/pet/findByStatus
Purpose: Fetches pets based on their status (e.g., available, sold, or pending).
Action: Allows fetching data from the system. Monitoring usage of such endpoints is crucial for ensuring it isn't used inappropriately or excessively.
POST /api/v3/user/createWithList
Purpose: Creates a user with a list of attributes.
Action: Monitors the creation of new users and ensures secure handling of the input data, protecting against threats like data injection or misuse.
The Endpoint Overview section provides a comprehensive breakdown of each API endpoint, helping you monitor its performance and security. This detailed view allows you to manage and optimize your APIs more effectively while safeguarding them from potential threats.
Endpoint Details:
URI The URI (Uniform Resource Identifier) is the specific address of the API endpoint. For example, /api/v3/pet/findByStatus defines the path for fetching pets based on their status. This identifier helps you pinpoint the exact location of each API within your application.
Endpoint Method The HTTP method used by the endpoint indicates the action being performed. Common methods include:
GET: Retrieves data from the API.
POST: Sends data to the server, often for creating or updating resources.
DELETE: Removes a resource from the system.
PUT: Updates an existing resource.
Headers This section displays any custom headers that are required for the endpoint. These could include authorization tokens, content types, or other metadata needed for proper request handling.
Query Parameters Query Parameters are optional parameters appended to the URI that can alter the API’s response. For example, a status query parameter could be used to filter results, such as showing only pets that are available or sold.
Body Parameters For POST or PUT requests, Body Parameters refer to the data sent in the body of the request. These parameters typically contain the details necessary to create or modify a resource, such as user information or pet attributes.
Endpoint Traffic Endpoint Traffic tracks the total number of requests made to the API endpoint over a specific period, such as the last 24 hours. This metric helps you understand the usage patterns of the endpoint and identify any traffic anomalies or overloads.
Endpoint Attacks The Endpoint Attacks section shows whether any malicious activities or security threats have been detected targeting the endpoint. This helps you monitor and respond to attacks, such as SQL injections or brute-force attempts, ensuring the endpoint remains secure.
Analytics tools offer a comprehensive way to monitor and secure your APIs in real-time, enabling you to identify patterns and threats effectively. Here's how each tool contributes to the security and performance of your endpoints:
Attack Analytics Provides a visual representation of attack patterns targeting specific APIs, updated for the last 24 hours. This helps you visualize threats such as SQL injections, DDoS attacks, or brute force attempts, allowing you to take timely actions to protect your endpoints.
Traffic Analytics Tracks the traffic flow to the API and identifies anomalies over time. This feature helps detect unexpected spikes in traffic or unusual usage patterns that might indicate malicious behavior or system overloads.
Top IP Addresses Displays the most active IP addresses interacting with the API. This can help you identify sources of excessive requests and suspicious activity, providing insight into potential threats or abusive behavior.
Top Countries Shows the geographic regions generating the most API requests. This allows you to analyze traffic patterns and detect whether unusual amounts of traffic are coming from specific regions, potentially signaling an attack or misuse from certain locations.
Status Codes Displays the response status codes returned by the API (e.g., 200, 400, 404). Monitoring status codes helps you identify broken endpoints (404 errors), unauthorized access (401 errors), or server-side issues (500 errors) that could indicate attacks or other problems.
This section provides insights into the inputs used for each API call, including headers, query parameters, and body parameters, which are essential for securing and validating requests.
Example: Query Parameter: The status parameter for /api/v3/pet/findByStatus determines which pets to fetch based on their status (e.g., available, sold, etc.).
Tracks malicious activities targeting APIs, showing whether an endpoint has been targeted by attacks. For example, a report may show "0 attacks" on a particular endpoint, which helps you identify vulnerabilities and take preventive measures before issues arise.
Provides real-time data on legitimate and malicious traffic interacting with APIs. This helps you analyze traffic trends and take corrective actions, such as blocking abusive IP addresses or limiting traffic from suspicious sources.
● Purpose: Fetches a list of pets filtered by their status.
● Traffic & Security:
○ Endpoint Traffic: Shows how many requests are being made to this endpoint.
○ Endpoint Attacks: Tracks if this endpoint has been targeted by attackers.
● Analytics: Administrators can monitor which IPs are accessing the API and where the traffic is coming from.
● Comprehensive Monitoring: Provides complete visibility into API traffic and activity.
● Enhanced Security: Monitors potential threats and helps protect APIs against vulnerabilities.
● Actionable Insights: Offers detailed analytics and logs for real-time decision-making.
Prophaze’s API Security solution is designed to provide end-to-end protection for your APIs. From real-time monitoring and attack prevention to detailed analytics and reporting, Prophaze ensures that your API infrastructure is secure, efficient, and ready to handle modern threats.
