Difference between revisions of "API"

From BC$ MobileTV Wiki
Jump to: navigation, search
(API Security Testing)
 
(37 intermediate revisions by the same user not shown)
Line 54: Line 54:
 
* AsyncAPI: https://www.asyncapi.com/
 
* AsyncAPI: https://www.asyncapi.com/
 
* AsyncAPI – Documentation of event- and message-driven architectures: https://blog.codecentric.de/en/2021/09/asyncapi-documentation-event-message-driven-architectures/
 
* AsyncAPI – Documentation of event- and message-driven architectures: https://blog.codecentric.de/en/2021/09/asyncapi-documentation-event-message-driven-architectures/
 +
  
 
=== APIs.json ===
 
=== APIs.json ===
Line 225: Line 226:
 
=== API Keys & Security ===
 
=== API Keys & Security ===
  
 +
* OWASP Application Security Verification Standard (ASVS): https://owasp.org/www-project-application-security-verification-standard/
 +
* OWASP Top 10 - API Security: https://owasp.org/www-project-api-security/ | [https://apisecurity.io/encyclopedia/content/owasp-api-security-top-10-cheat-sheet-us-letter.pdf POSTER]<ref>'''Demystifying the "OWASP API security top 10": https://media.bitpipe.com/io_15x/io_157878/item_2411117/cqnc-ebook-owasp.pdf'''</ref>
 
* REST Security (CHEAT SHEET): https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
 
* REST Security (CHEAT SHEET): https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
 +
<ref>Predicting the Next OWASP API Security Top 10: https://threatpost.com/owasp-api-security-top-10/175961/</ref>
 +
<ref>The 2021 Guide to API Security -- What You Need to Know: https://appsecengineer.com/hackerman-hub/2021-guide-api-security-what-you-need-know</ref>
 +
<ref>The state of API Security 2022 - global research comparison: https://www.cybersprint.com/blog/the-state-of-api-security-global-research-comparison</ref>
 +
<ref>API Security - The Complete Guide: https://brightsec.com/blog/api-security/</ref>
 +
<ref>So, Like, What is an API Key Really? And How Does it Provide Security?: https://hackernoon.com/so-like-what-is-an-api-key-really-and-how-does-it-provide-security</ref>
 +
<ref>Ownership Of The API Security Lifecycle Attribution link: https://latesthackingnews.com/2022/05/27/ownership-of-the-api-security-lifecycle/ (HINT: if its "everybody's" responsibility, its really "no one's"... have a single or primary/secondary owner, and inform/empower everyone else in the organization to contribute)</ref>
 +
<ref>More Simple = Less API Attack Vectors: https://securityboulevard.com/2022/01/more-simple-less-api-attack-vectors/</ref>
 +
<ref>Positive API Security Model, and Why You Need It!: https://42crunch.com/webinar-positive-api-security-model/</ref>
 +
<ref>'''c'''ompletely '''r'''idiculous '''A'''pplication '''P'''rogramming '''I'''nterface (crAPI): https://github.com/owasp/crapi | [https://infosecwriteups.com/crapi-api-security-the-hacker-way-7f8402bb6e65 DOCS]</ref>
 +
<ref>Why does API Security Need Special Attention?: https://economictimes.indiatimes.com/why-does-api-security-need-special-attention/articleshow/92053756.cms</ref>
 +
<ref>Microsoft's Recommendations to mitigate ''OWASP API Security Top 10'' threats using API Management: https://docs.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats</ref>
 +
<ref>API Security Checklist -- The Top 7 Requirements: https://www.indusface.com/blog/api-security-checklist-the-top-7-requirements/</ref>
 +
* '''API security design best practices for enterprise and public cloud: https://habr.com/en/post/595075/'''
 +
<ref>'''Awesome API Security: https://github.com/arainho/awesome-api-security'''</ref>
 +
<ref>Best practices for REST API security - Authentication and authorization: https://stackoverflow.blog/2021/10/06/best-practices-for-authentication-and-authorization-for-rest-apis/</ref>
 +
<ref>Collection of awesome API Security tools & resources: https://reconshell.com/api-security/</ref>
 +
<ref>API Sprawl a Looming Threat to Digital Economy: https://devops.com/api-sprawl-a-looming-threat-to-digital-economy/</ref>
 +
<ref>Benefits of Adopting Zero Trust for API Security: https://www.cm-alliance.com/cybersecurity-blog/benefits-of-adopting-zero-trust-for-api-security</ref>
 +
<ref>HTTP request smuggling: https://portswigger.net/web-security/request-smuggling</ref>
 
<ref>Why API Keys are not enough: https://nordicapis.com/why-api-keys-are-not-enough/</ref>
 
<ref>Why API Keys are not enough: https://nordicapis.com/why-api-keys-are-not-enough/</ref>
<ref>Best Practices for Storing / Protecting API Keys : https://developer.oregonstate.edu/faqs/best-practices-storing-protecting-api-keys</ref>
+
<ref>Best Practices for Storing / Protecting API Keys: https://developer.oregonstate.edu/faqs/best-practices-storing-protecting-api-keys</ref>
 
<ref>Google Developers - API Key Best Practices: https://developers.google.com/maps/api-key-best-practices</ref>
 
<ref>Google Developers - API Key Best Practices: https://developers.google.com/maps/api-key-best-practices</ref>
 
<ref>Google Developers - Guide to Using API Keys: https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=636795263018130436-4272006704&rd=1</ref>
 
<ref>Google Developers - Guide to Using API Keys: https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=636795263018130436-4272006704&rd=1</ref>
Line 241: Line 263:
 
<ref>Equipping Your API With The Right Armor: https://nordicapis.com/api-security-equipping-your-api-with-the-right-armor/</ref>
 
<ref>Equipping Your API With The Right Armor: https://nordicapis.com/api-security-equipping-your-api-with-the-right-armor/</ref>
 
<ref>Techniques and Technologies to Increase API Security: https://nordicapis.com/building-a-secure-api/</ref>
 
<ref>Techniques and Technologies to Increase API Security: https://nordicapis.com/building-a-secure-api/</ref>
 +
<ref>Application Security Tools Are Not up to the Job of API Security: https://thenewstack.io/application-security-tools-are-not-up-to-the-job-of-api-security/</ref>
 +
<ref>A Case Study of API Vulnerabilities: https://monke.ie/api-vulns-casestudy/</ref>
 +
<ref>''Google Cloud'' sees storm brewing over API security: https://www.theregister.com/2022/04/26/google_cloud_api/</ref>
 +
<ref>The API Security Maturity Model: https://curity.io/resources/learn/the-api-security-maturity-model/</ref>
 +
<ref>API Key Management with API Portal and Spring Cloud Gateway for Kubernetesh: ttps://tanzu.vmware.com/content/blog/api-key-management-api-portal-spring-cloud-gateway-for-kubernetes</ref>
 +
<ref>Akamai -- APIs - The Attack Surface That Connects Us All (WHITEPAPER): https://www.akamai.com/resources/state-of-the-internet/soti-security-api-the-attack-surface-that-connects-us-all</ref>
 +
<ref>API Security in Action (BOOK): https://www.manning.com/books/api-security-in-action</ref>
 +
<ref>The Danger of API Security Overconfidence - Four Takeaways from Radware’s 2022 State of API Security Survey: https://securityboulevard.com/2022/06/the-danger-of-api-security-overconfidence-four-takeaways-from-radwares-2022-state-of-api-security-survey/</ref>
 +
<ref>One in every 13 incidents blamed on API insecurity – report: https://portswigger.net/daily-swig/one-in-every-13-incidents-blamed-on-api-insecurity-report</ref>
 +
<ref>Poor API security may cost orgs up to $75B per year: https://venturebeat.com/2022/06/22/vulnerable-apis-75bn/ | [https://www.imperva.com/resources/resource-library/reports/quantifying-the-cost-of-api-insecurity/ REPORT]</ref>
 +
  
 
==== API Security Testing ====
 
==== API Security Testing ====
  
 
* KiteRunner -- content discovery & API probing tool: https://github.com/assetnote/kiterunner
 
* KiteRunner -- content discovery & API probing tool: https://github.com/assetnote/kiterunner
<ref>Go Fuzz Yourself – How to Find More Vulnerabilities in APIs Through Fuzzing: https://labs.detectify.com/2021/08/31/go-fuzz-yourself-how-to-find-more-vulnerabilities-in-apis-through-fuzzing-whitepaper-download/?utm_source=referral&utm_medium=referral&utm_campaign=alissaknight</ref>
+
* Vulnerable Adversely Programmed Interface (vAPI): https://www.postman.com/roottusk/workspace/vapi/overview | [https://github.com/roottusk/vapi SRC] (sample set of APIs that mimic all the "[https://owasp.org/www-project-api-security/ OWASP Top 10 - API Security]" issues to perform PenTest/Security exercises against)
 +
* API Testing Checklist: https://hackanythingfor.blogspot.com/2020/07/api-testing-checklist.html
 +
<ref>Introducing vAPI – an open source lab environment to learn about API security: https://portswigger.net/daily-swig/introducing-vapi-an-open-source-lab-environment-to-learn-about-api-security</ref>
 +
<ref>Go Fuzz Yourself – How to Find More Vulnerabilities in APIs Through Fuzzing: https://labs.detectify.com/2021/08/31/go-fuzz-yourself-how-to-find-more-vulnerabilities-in-apis-through-fuzzing-whitepaper-download/</ref>
 
<ref>Save API Costs With "Data-Centric Security": https://hackernoon.com/save-api-costs-with-data-centric-security</ref>
 
<ref>Save API Costs With "Data-Centric Security": https://hackernoon.com/save-api-costs-with-data-centric-security</ref>
 +
<ref>More Simple = Less API Attack Vectors: https://securityboulevard.com/2022/01/more-simple-less-api-attack-vectors/</ref>
 +
<ref>OWASP Juice Shop: https://owasp.org/www-project-juice-shop/</ref>
 +
<ref>How to Simplify Your API to Narrow Attack Vectors: https://www.threatx.com/blog/api-attack-vectors-how-to-narrow-reduce/</ref>
 +
<ref>Intercepting HTTPS traffic with Burp Suite: https://resources.infosecinstitute.com/topic/intercepting-https-traffic-with-burp-suite/</ref>
 +
<ref>API Security Testing With Postman and OWASP Zap: https://thetesttherapist.com/2022/02/13/api-security-testing-with-postman-and-owasp-zap/</ref>
 +
<ref>Hacking and reviewing Elgato Key Light API with Postman: https://apihandyman.io/hacking-elgato-key-light-with-postman/</ref>
  
 
== Tools ==
 
== Tools ==
Line 288: Line 330:
 
See: [[Testing#ServiceV | ServiceV]]
 
See: [[Testing#ServiceV | ServiceV]]
  
 +
 +
==== Postman ====
 +
 +
<ref>Postman Collection for Salesforce - Mock Servers & Code Snippets: https://dzone.com/articles/postman-collection-for-salesforce-mock-servers-and</ref>
  
 
== Resources ==
 
== Resources ==
Line 301: Line 347:
 
* API Insecurity -- The Lurking Threat In Your Software: https://go.forrester.com/blogs/the-power-and-the-peril-of-apis/ | [https://www.forrester.com/report/API+Insecurity+The+Lurking+Threat+In+Your+Software/-/E-RES142080?objectid=RES142080 2020 REPORT]
 
* API Insecurity -- The Lurking Threat In Your Software: https://go.forrester.com/blogs/the-power-and-the-peril-of-apis/ | [https://www.forrester.com/report/API+Insecurity+The+Lurking+Threat+In+Your+Software/-/E-RES142080?objectid=RES142080 2020 REPORT]
 
<ref>'''API Tokens -- A Tedious Survey: https://fly.io/blog/api-tokens-a-tedious-survey/'''</ref>
 
<ref>'''API Tokens -- A Tedious Survey: https://fly.io/blog/api-tokens-a-tedious-survey/'''</ref>
 +
<ref> Checklist for API Verification: https://dzone.com/articles/checklist-for-api-verification</ref>
 
<ref>10 API security guidelines and best practices: https://searchapparchitecture.techtarget.com/tip/10-API-security-guidelines-and-best-practices</ref>
 
<ref>10 API security guidelines and best practices: https://searchapparchitecture.techtarget.com/tip/10-API-security-guidelines-and-best-practices</ref>
 +
<ref>The 10 REST Commandments: https://treblle.com/blog/the-10-rest-commandments</ref>
 
<ref>Using APIs With PHP? Here Are Your Classes: http://jeez.eu/2009/11/23/using-apis-with-php-here-are-your-classes/</ref>
 
<ref>Using APIs With PHP? Here Are Your Classes: http://jeez.eu/2009/11/23/using-apis-with-php-here-are-your-classes/</ref>
 
<ref>Developer Experience (BLOG): https://web.archive.org/web/20180831161730/http://developerexperience.org/day/2012/05/01</ref>
 
<ref>Developer Experience (BLOG): https://web.archive.org/web/20180831161730/http://developerexperience.org/day/2012/05/01</ref>
Line 318: Line 366:
 
* Favourite Quote of the Day API: https://favqs.com/api/ | [https://favqs.com/api/qotd EXAMPLE]
 
* Favourite Quote of the Day API: https://favqs.com/api/ | [https://favqs.com/api/qotd EXAMPLE]
 
* OpenTrivia Database (OpenTDB): https://opentdb.com/ | [https://opentdb.com/api_config.php API] | [https://opentdb.com/api.php?amount=1 DEMO]
 
* OpenTrivia Database (OpenTDB): https://opentdb.com/ | [https://opentdb.com/api_config.php API] | [https://opentdb.com/api.php?amount=1 DEMO]
 +
* TheMealDB: https://www.themealdb.com | [https://www.themealdb.com/api.php API]
 
* Edamam Food Analysis APIs: https://developer.edamam.com//#registrationModal| [https://developer.edamam.com/edamam-nutrition-api Nutrition API] | [https://developer.edamam.com/edamam-nutrition-api-demo DEMO]
 
* Edamam Food Analysis APIs: https://developer.edamam.com//#registrationModal| [https://developer.edamam.com/edamam-nutrition-api Nutrition API] | [https://developer.edamam.com/edamam-nutrition-api-demo DEMO]
 
* ChuckNorris jokes API: https://api.chucknorris.io/jokes/random
 
* ChuckNorris jokes API: https://api.chucknorris.io/jokes/random
Line 367: Line 416:
 
* API Development -- Design-First or Code-First?: http://dzone.com/articles/design-first-or-code-first-whats-the-best-approach
 
* API Development -- Design-First or Code-First?: http://dzone.com/articles/design-first-or-code-first-whats-the-best-approach
 
* Designing a Usable, Flexible, Long-Lasting API: https://dzone.com/articles/designing-a-usable-flexible-long-lasting-api
 
* Designing a Usable, Flexible, Long-Lasting API: https://dzone.com/articles/designing-a-usable-flexible-long-lasting-api
 +
* REST API Design - Resource Modeling: https://www.thoughtworks.com/insights/blog/rest-api-design-resource-modeling<ref>Don’t Use CRUD Styled APIs, Consider Intent-Based Rest APIs: https://betterprogramming.pub/intent-based-rest-apis-or-an-alternative-to-crud-based-rest-apis-1815599db60a</ref>
 +
* If the Backend API Returns 100,000 Records at One Time, How Should We Handle it in the Frontend?: https://medium.com/frontend-canteen/if-the-backend-api-returns-100-000-records-at-one-time-how-should-we-handle-it-in-the-frontend-fab21218fe2
 +
 
* Using API Gateways to Facilitate Your Transition from Monolith to Microservices: https://itnext.io/using-api-gateways-to-facilitate-your-transition-from-monolith-to-microservices-c08fe3489237
 
* Using API Gateways to Facilitate Your Transition from Monolith to Microservices: https://itnext.io/using-api-gateways-to-facilitate-your-transition-from-monolith-to-microservices-c08fe3489237
 
* The Role of API Gateways in API Security: https://dzone.com/articles/the-role-of-api-gateways-in-api-security<ref>Design patterns for Microservices: https://dzone.com/articles/design-patterns-for-microservices</ref><ref>API Management of comparative views of "real-world" design: https://dzone.com/guides/api-management-comparative-views-of-real-world-des</ref>
 
* The Role of API Gateways in API Security: https://dzone.com/articles/the-role-of-api-gateways-in-api-security<ref>Design patterns for Microservices: https://dzone.com/articles/design-patterns-for-microservices</ref><ref>API Management of comparative views of "real-world" design: https://dzone.com/guides/api-management-comparative-views-of-real-world-des</ref>
Line 377: Line 429:
 
* ffuf on Steroids: https://securityjunky.com/ffuf-on-steroids/
 
* ffuf on Steroids: https://securityjunky.com/ffuf-on-steroids/
 
* A visual history of web API architecture: https://itnext.io/a-visual-history-of-web-api-architecture-c36044df2ac7
 
* A visual history of web API architecture: https://itnext.io/a-visual-history-of-web-api-architecture-c36044df2ac7
 +
* Build a Java REST API (with OICD/JWT auth) using Quarkus: https://dzone.com/articles/build-a-java-rest-api-with-quarkus
 +
* How to Improve an API Ecosystem with Mapping: https://blog.postman.com/how-to-improve-api-ecosystem-with-mapping/ (includes an interesting take on "Top 10 strategic issues to address in any API")
  
  
Line 429: Line 483:
 
* API Is Dead – Long Live the APIs: https://dzone.com/articles/api-is-dead-long-live-the-apis (how the reign of REST APIs is declining and how the ecosystem is moving towards democracy)
 
* API Is Dead – Long Live the APIs: https://dzone.com/articles/api-is-dead-long-live-the-apis (how the reign of REST APIs is declining and how the ecosystem is moving towards democracy)
 
* 7 Apps You Can Definitely Build With These Free APIs: https://medium.com/madhash/7-apps-you-can-definitely-build-with-these-free-apis-6d30124527fc
 
* 7 Apps You Can Definitely Build With These Free APIs: https://medium.com/madhash/7-apps-you-can-definitely-build-with-these-free-apis-6d30124527fc
 +
* Akamai Security Research - APIs Are Now Target of Choice for Cybercriminals Attacking Financial Services Organizations: https://www.akamai.com/newsroom/press-release/state-of-the-internet-security-financial-services-hostile-takeover-attempts (up to 75% of all Credential Abuse Attacks Targeted APIs )
 +
* Rapid proliferation of APIs opens up new security holes: https://www.scmagazine.com/analysis/application-security/rapid-proliferation-of-apis-opens-up-new-security-holes
  
  

Latest revision as of 17:22, 22 July 2022

An Application Programming Interface (or commonly abbreviated as API), is a mechanism for exposing the core functionality of an application (such as a client or desktop program, web site or web service) to an external application (of any of the previously mentioned types).

Since the days of Web 2.0, an API is seen as a crucial element to any Web Application or Web Service. In general though, APIs are crucial parts of an application design and implementation strategy. They ensure the involvement of third-parties and outside developers in the products and services you create, and they can also help to breed innovation.


Specifications

OpenAPI

Swagger (OpenAPIv2) to OpenAPIv3

OpenAPI is an OSS specification and associated OSS (with commercial/enterprise-grade supported options) set of tools for Designing, Documenting, Sharing, Inspecting/Analyzing, Stubbing/Mocking, Validating, Comparing and/or Serving API endpoints and their associated Auth mechanisms, Headers, request/response pair examples, actual payloads, error messsages/conditions around, etc. It is seen as the cross-platform (SOAP, REST, REST-JSON/XML, XML-RPC, etc) Web Service documentation alternative to the more protocol-specific WSDL (SOAP) & WADL (REST) specifications.

For more, see: OpenAPI

[2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]


AsyncAPI

Event Driven Architecture (EDA) focused API specification format that supports special documentation for push, WebHooks, messaging, long-polling, etc...


APIs.json

APIs.json is a machine readable approach that API providers can use to describe their API operations, similar to how web sites are described using the Sitemap.xml spec but for listing/discovery of Web Services and their operations.

[13]


RAML

Rest API Markup Language (RAML) is Mulesoft's alternative to Swagger/OpenAPI.


WADL

Web Application Description Language (WADL).

For more, see: WADL


Types of APIs

Native/Library

A Native or Library API is typically an operating system-specific or programming language-specific one which provides access to certain data, methods/functionality, or commonly required utilities.

Web Services

Web Services are remotely callable functionality residing in another application.

XML-RPC

XML-RPC was one of the first examples of a Web Service format for remotely exchanging data, specifying the format as a strict set of XML "methods" and.

RequestResponse
 <?xml version="1.0" encoding="utf-8"?>
 <methodCall>
    <methodName>myService.sum</methodName>
    <params>
       <param>
          <value><int>17</int></value>
       </param>	 
       <param>
          <value><int>13</int></value>
       </param>
    </params>
 </methodCall>
 <methodResponse>
    <params>
       <param>
          <value><int>30</int></value>
       </param>
    </params>
 </methodResponse>


SOAP

SOAP is a contract-based (contract-first or contract-last, but contract nonetheless) approach to cross-application communication.

RequestResponse

GET http://www.mysite.com/myService?wsdl

--> Lookup required Web Service "operation"

POST http://www.mysite.com/getAddition

 <?xml version="1.0" encoding="utf-8"A?>
 <soap:Envelope
    xmlns:soap="http://www.w3.org/2003/05/soap-envelope/"
    soap:encodingStyle="http://www.w3.org/2003/05/soap-encoding">
   <soap:Header>
      <To xmlns="http://www.w3.org/2005/08/addressing">http://www.mysite.com:8181/Math/</To>
      <Action xmlns="http://www.w3.org/2005/08/addressing">tns:getAdditon_Request</Action>
      <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
         <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
      </ReplyTo>
   </soap:Header>
   <soap:Body>
   <Math:getAddition>
      <Math:number1>17</Math:number1>
      <Math:number2>13</Math:number2>
   </Math:getAddition>
   </soap:Body>
 </soap:Envelope> 
 <?xml version="1.0" encoding="utf-8"A?>
 <soap:Envelope
    xmlns:soap="http://www.w3.org/2003/05/soap-envelope/"
    soap:encodingStyle="http://www.w3.org/2003/05/soap-encoding">
   <soap:Header>
       <ResponseHeader xmlns="https://www.mysite.com/apis/Math/v2017-08-17">
         <requestId>123456789</requestId>
         <responseTime>1350</responseTime>
       </ResponseHeader>
   </soap:Header>
   <soap:Body>
     <Math:getAddition>
        <Math:value>30</Math:value>
     </Math:getAddition>
   </soap:Body>
 </soap:Envelope>
  • For more, see section: SOAP

REST

REST is a direct access-based approach to cross-application communication, where the API's documentation is typically relied upon heavily to describe how to access it. When REST is done properly though, using a RESTful approach, the API becomes mostly self-documenting, instead relying on the Create-Read-Update-Delete (CRUD) to HTTP POST-GET-PUT-DELETE relationship to describe how to access the Web Service and interact with its data.

RequestResponse
GET http://www.mysite.com/myService?number=17&number2=13
 {
   "value" : "30"
 }

Although, in reality a REST endpoint can be as complex or simplistic to call as you want, to be truly "RESTful" it should follow certain conventions. The simplistic example above of passing two numbers as input parameters would likely be highly criticized by RESTful WS purist, perhaps to look more like this:

GET http://www.mysite.com/add/{input1}/{input2}

Others still may argue that since it is "changing a resource" (i.e. doing addition with the two inputs its given) it should be a POST request without any parameters or additional paths beyond and the inputs should be passed in the HTTP message body:

POST http://www.mysite.com/add
BODY input1=17&input2=13

There is no right or wrong answer, only opinion, as the REST approach is far less structured/defined and more open to interpretation.

  • For more, see section: REST


API Design

5 essentials for a great API

  1. Provide a valuable service
  2. Have a plan and a business model
  3. Make it simple and flexible
  4. It should be managed and measured
  5. Provide great developer support (Docs, API Console, Example Client Implementations/SDKs, Sandbox)[15]

API Keys & Security

[17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28]

[29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59]


API Security Testing

[60] [61] [62] [63] [64] [65] [66] [67] [68]

Tools


API Management

[82]

SoapUI

See: SoapUI

ServiceV

See: ServiceV


Postman

[83]

Resources

[85] [86] [87] [88] [89] [90] [91]

EXAMPLES


JavaScript

JavaScript APIs (sometimes called JSON APIs or JSONp APIs) require only a standard <script> tag to be added to a webpage in order to expose their functionality. For example:

 <script type="text/javascript" src="http://www.somesite.com/somejavascript.js"></script>

would expose the functionalities of the somejavascript API that belongs to somesite.com

Java

Java has strong support for intra-application and inter-application integration and interaction via making publically callable methods so that other programs can reuse application logic and methods.

C

The most widespread APIs in use today though, are probably the C APIs available for Unix and ported to other systems. These make it possible to do a number of complex tasks using a much smaller amount of code than if every set of logic had to be programmed manually.


Tutorials


External Links


References

  1. What is OpenAPI?: https://swagger.io/docs/specification/about/
  2. The OpenAPI Specification Version 3.0 Highlights: https://apievangelist.com/2017/01/25/the-openapi-specification-version-30-highlights/
  3. Open API Initiative Announces Release of the OpenAPI Spec v3 Implementer’s Draft: https://www.openapis.org/blog/2017/03/01/openapi-spec-3-implementers-draft-released
  4. OpenAPI 3.0, And What It Means for the Future of Swagger (WEBINAR): https://swaggerhub.com/blog/api-resources/openapi-3-0-video-tutorial/ | SLIDES
  5. A Visual Guide to What's New in Swagger 3.0: https://blog.readme.io/an-example-filled-guide-to-swagger-3-2/
  6. Comparing OpenAPI/Swagger 2.0 and 3.0.0-rc1: https://dev.to/mikeralphson/comparing-openapiswagger-20-and-300-rc1
  7. What’s New in OpenAPI 3.0: http://nordicapis.com/whats-new-in-openapi-3-0/
  8. Looking to Create OpenAPI 3.0 For Your API? Swagger Inspector Has Your Back: https://swagger.io/blog/convert-oas-3-swagger-inspector/#sendgrid_mc_email_subscribe
  9. Migrating to OpenAPI 3.0 -- How to Convert Your Existing APIs with Swagger Tools: https://swagger.io/resources/webinars/convert-api-to-oas-3-with-swagger-tools/
  10. Tutorial - Converting your Swagger 2.0 API Definition to OpenAPI 3.0: https://blog.runscope.com/posts/tutorial-upgrading-swagger-2-api-definition-to-openapi-3
  11. Collaborating Across the API Lifecycle -- How to Setup an API Workflow that Scales: https://swagger.io/resources/webinars/collaborating-across-the-api-lifecycle/
  12. How about OpenAPI descriptions and Swagger UI in your Java REST API?: https://tryingthings.wordpress.com/2020/05/20/how-about-openapi-descriptions-and-swagger-ui-in-your-java-rest-api/
  13. API Discovery Is for Internal or External Services: https://dzone.com/articles/api-discovery-is-for-internal-or-external-services
  14. wikipedia: RAML (software)
  15. Is the API Landscape Broken?: http://www.wired.com/insights/2013/01/is-the-api-landscape-broken/
  16. Demystifying the "OWASP API security top 10": https://media.bitpipe.com/io_15x/io_157878/item_2411117/cqnc-ebook-owasp.pdf
  17. Predicting the Next OWASP API Security Top 10: https://threatpost.com/owasp-api-security-top-10/175961/
  18. The 2021 Guide to API Security -- What You Need to Know: https://appsecengineer.com/hackerman-hub/2021-guide-api-security-what-you-need-know
  19. The state of API Security 2022 - global research comparison: https://www.cybersprint.com/blog/the-state-of-api-security-global-research-comparison
  20. API Security - The Complete Guide: https://brightsec.com/blog/api-security/
  21. So, Like, What is an API Key Really? And How Does it Provide Security?: https://hackernoon.com/so-like-what-is-an-api-key-really-and-how-does-it-provide-security
  22. Ownership Of The API Security Lifecycle Attribution link: https://latesthackingnews.com/2022/05/27/ownership-of-the-api-security-lifecycle/ (HINT: if its "everybody's" responsibility, its really "no one's"... have a single or primary/secondary owner, and inform/empower everyone else in the organization to contribute)
  23. More Simple = Less API Attack Vectors: https://securityboulevard.com/2022/01/more-simple-less-api-attack-vectors/
  24. Positive API Security Model, and Why You Need It!: https://42crunch.com/webinar-positive-api-security-model/
  25. completely ridiculous Application Programming Interface (crAPI): https://github.com/owasp/crapi | DOCS
  26. Why does API Security Need Special Attention?: https://economictimes.indiatimes.com/why-does-api-security-need-special-attention/articleshow/92053756.cms
  27. Microsoft's Recommendations to mitigate OWASP API Security Top 10 threats using API Management: https://docs.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats
  28. API Security Checklist -- The Top 7 Requirements: https://www.indusface.com/blog/api-security-checklist-the-top-7-requirements/
  29. Awesome API Security: https://github.com/arainho/awesome-api-security
  30. Best practices for REST API security - Authentication and authorization: https://stackoverflow.blog/2021/10/06/best-practices-for-authentication-and-authorization-for-rest-apis/
  31. Collection of awesome API Security tools & resources: https://reconshell.com/api-security/
  32. API Sprawl a Looming Threat to Digital Economy: https://devops.com/api-sprawl-a-looming-threat-to-digital-economy/
  33. Benefits of Adopting Zero Trust for API Security: https://www.cm-alliance.com/cybersecurity-blog/benefits-of-adopting-zero-trust-for-api-security
  34. HTTP request smuggling: https://portswigger.net/web-security/request-smuggling
  35. Why API Keys are not enough: https://nordicapis.com/why-api-keys-are-not-enough/
  36. Best Practices for Storing / Protecting API Keys: https://developer.oregonstate.edu/faqs/best-practices-storing-protecting-api-keys
  37. Google Developers - API Key Best Practices: https://developers.google.com/maps/api-key-best-practices
  38. Google Developers - Guide to Using API Keys: https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=636795263018130436-4272006704&rd=1
  39. Client-Side Storage options with HTML5: https://www.html5rocks.com/en/tutorials/offline/storage/
  40. Best Practices for Designing a Pragmatic RESTful API: https://www.vinaysahni.com/best-practices-for-a-pragmatic-restful-api
  41. Best practices for building secure API Keys: https://medium.freecodecamp.org/best-practices-for-building-api-keys-97c26eabfea9
  42. Best practices for securely storing API keys: https://medium.freecodecamp.org/how-to-securely-store-api-keys-4ff3ea19ebda
  43. Best practices for securely using API keys: https://support.google.com/googleapi/answer/6310037
  44. API Key Auth Provider (C#): http://docs.servicestack.net/api-key-authprovider#interoperable
  45. Reducing Risk of Credential Compromise @Netflix: https://www.infoq.com/presentations/netflix-infrastructure-security
  46. API Security -- Deep Dive into OAuth and OpenID Connect: https://nordicapis.com/api-security-oauth-openid-connect-depth/
  47. API Security -- The 4 Defenses of The API Stronghold: https://nordicapis.com/api-security-the-4-defenses-of-the-api-stronghold/
  48. Equipping Your API With The Right Armor: https://nordicapis.com/api-security-equipping-your-api-with-the-right-armor/
  49. Techniques and Technologies to Increase API Security: https://nordicapis.com/building-a-secure-api/
  50. Application Security Tools Are Not up to the Job of API Security: https://thenewstack.io/application-security-tools-are-not-up-to-the-job-of-api-security/
  51. A Case Study of API Vulnerabilities: https://monke.ie/api-vulns-casestudy/
  52. Google Cloud sees storm brewing over API security: https://www.theregister.com/2022/04/26/google_cloud_api/
  53. The API Security Maturity Model: https://curity.io/resources/learn/the-api-security-maturity-model/
  54. API Key Management with API Portal and Spring Cloud Gateway for Kubernetesh: ttps://tanzu.vmware.com/content/blog/api-key-management-api-portal-spring-cloud-gateway-for-kubernetes
  55. Akamai -- APIs - The Attack Surface That Connects Us All (WHITEPAPER): https://www.akamai.com/resources/state-of-the-internet/soti-security-api-the-attack-surface-that-connects-us-all
  56. API Security in Action (BOOK): https://www.manning.com/books/api-security-in-action
  57. The Danger of API Security Overconfidence - Four Takeaways from Radware’s 2022 State of API Security Survey: https://securityboulevard.com/2022/06/the-danger-of-api-security-overconfidence-four-takeaways-from-radwares-2022-state-of-api-security-survey/
  58. One in every 13 incidents blamed on API insecurity – report: https://portswigger.net/daily-swig/one-in-every-13-incidents-blamed-on-api-insecurity-report
  59. Poor API security may cost orgs up to $75B per year: https://venturebeat.com/2022/06/22/vulnerable-apis-75bn/ | REPORT
  60. Introducing vAPI – an open source lab environment to learn about API security: https://portswigger.net/daily-swig/introducing-vapi-an-open-source-lab-environment-to-learn-about-api-security
  61. Go Fuzz Yourself – How to Find More Vulnerabilities in APIs Through Fuzzing: https://labs.detectify.com/2021/08/31/go-fuzz-yourself-how-to-find-more-vulnerabilities-in-apis-through-fuzzing-whitepaper-download/
  62. Save API Costs With "Data-Centric Security": https://hackernoon.com/save-api-costs-with-data-centric-security
  63. More Simple = Less API Attack Vectors: https://securityboulevard.com/2022/01/more-simple-less-api-attack-vectors/
  64. OWASP Juice Shop: https://owasp.org/www-project-juice-shop/
  65. How to Simplify Your API to Narrow Attack Vectors: https://www.threatx.com/blog/api-attack-vectors-how-to-narrow-reduce/
  66. Intercepting HTTPS traffic with Burp Suite: https://resources.infosecinstitute.com/topic/intercepting-https-traffic-with-burp-suite/
  67. API Security Testing With Postman and OWASP Zap: https://thetesttherapist.com/2022/02/13/api-security-testing-with-postman-and-owasp-zap/
  68. Hacking and reviewing Elgato Key Light API with Postman: https://apihandyman.io/hacking-elgato-key-light-with-postman/
  69. How to Use Postman to Manage and Execute Your APIs: http://dzone.com/articles/how-to-use-postman-to-manage-and-execute-your-apis
  70. Cisco DevNet uses Postman to grow their developer community: http://blog.getpostman.com/2018/05/18/cisco-devnet-uses-postman-to-grow-their-developer-community/
  71. Rapido - A Sketching Tool for Web API Designers (WHITEPAPER): http://www.www2015.it/documents/proceedings/companion/p1509.pdf
  72. Sketching Web APIs: http://www.slideshare.net/ronniemitra/sketching-web-apis
  73. wikipedia: Burp suite
  74. AuthMatrix extension v0.8.1 for BurpSuite: https://github.com/SecurityInnovation/AuthMatrix
  75. BestBuy API - Getting Started guide: https://developer.bestbuy.com/documentation/getting-started
  76. Best Buy API - NodeJS SDK: http://github.com/BestBuyAPIs/bestbuy-sdk-js
  77. Former BestBuy BBYopen - Developer API console: http://web.archive.org/web/20130309114440/https://bbyopen.com/developer-tools/api-console
  78. Amazon Dev Tools - Signed Request Helper: https://aws.amazon.com/developertools/351
  79. Source Code for Brightcove API test tool: https://github.com/BrightcoveOS/API-Test-Tool
  80. Introducing Mashery: http://mashery.mashery.com/docs/Provider
  81. How Apiary works: https://apiary.io/how-it-works
  82. 10 Ways API Management Improves Product Development:: https://www.mulesoft.com/sites/default/files/resource-assets/10%20Ways%20API%20Management%20Improves%20Product%20Development.pdf
  83. Postman Collection for Salesforce - Mock Servers & Code Snippets: https://dzone.com/articles/postman-collection-for-salesforce-mock-servers-and
  84. Announcing Mule API Hub: http://blogs.mulesoft.com/dev/api-dev/introducing-apihub/
  85. API Tokens -- A Tedious Survey: https://fly.io/blog/api-tokens-a-tedious-survey/
  86. Checklist for API Verification: https://dzone.com/articles/checklist-for-api-verification
  87. 10 API security guidelines and best practices: https://searchapparchitecture.techtarget.com/tip/10-API-security-guidelines-and-best-practices
  88. The 10 REST Commandments: https://treblle.com/blog/the-10-rest-commandments
  89. Using APIs With PHP? Here Are Your Classes: http://jeez.eu/2009/11/23/using-apis-with-php-here-are-your-classes/
  90. Developer Experience (BLOG): https://web.archive.org/web/20180831161730/http://developerexperience.org/day/2012/05/01
  91. Two Breeds of API -- API Products .vs. API Solutions: http://api-as-a-product.com/articles/digital-transformation-api-product/
  92. Don’t Use CRUD Styled APIs, Consider Intent-Based Rest APIs: https://betterprogramming.pub/intent-based-rest-apis-or-an-alternative-to-crud-based-rest-apis-1815599db60a
  93. Design patterns for Microservices: https://dzone.com/articles/design-patterns-for-microservices
  94. API Management of comparative views of "real-world" design: https://dzone.com/guides/api-management-comparative-views-of-real-world-des
  95. Securing a REST Service: https://dzone.com/articles/securing-a-rest-service
  96. Swagger Generation With Spring Boot: https://dzone.com/articles/swagger-generation-with-spring-boot
  97. Versioning RESTful Services With Spring Boot: https://dzone.com/articles/versioning-restful-services-with-spring-boot
  98. Ffuf - A fast web fuzzer written in Go: https://hakin9.org/ffuf-a-fast-web-fuzzer-written-in-go/
  99. FFUF (Fuzz Faster U Fool) – An Open Source Fast Web Fuzzing ToolAttribution link: https://latesthackingnews.com/2019/12/08/ffuf-fuzz-faster-u-fool-an-open-source-fast-web-fuzzing-tool

See Also

Web Services | ESB | Microservices | API Gateway | Discovery | Security