API Security is the practice of protecting application programming interfaces (APIs) from misuse, unauthorized access, and data exposure across their full lifecycle.
APIs now carry most of the traffic between web apps, mobile clients, and microservices, which makes them a favorite target. Attackers probe for broken authentication, excessive data exposure, and missing rate limits rather than classic server flaws. Good API security combines strong authentication (OAuth 2.0 tokens, mutual TLS), authorization checks on every object a caller requests, input validation, and monitoring for abnormal call patterns.
A common mistake is trusting the client. Teams hide a field in the mobile interface and assume no one will request it, but an attacker calls the endpoint directly and pulls records that belong to other users. This is broken object level authorization, the top item on the OWASP API Security Top 10. Rate limiting and schema validation matter too, since a single unbounded query can drain a database.
How is API security tested on the CISSP?
The CISSP treats API security under Domain 8, Software Development Security, which covers secure coding, application controls, and the software supply chain. Expect scenario questions about where an authorization check belongs and how to protect the data an API returns. Review the topic alongside Domain 8 Software Development Security.