As application programming interfaces (APIs) grow in strategic importance, many organizations are initiating a gradual increase in the maturity and sophistication of their API security posture. These initiatives generally start with three primary activities:

\r\n \r\n Implementing API discovery to create a complete and accurate inventory of all sanctioned and unsanctioned APIs

\r\n

\r\n Eliminating unsanctioned APIs

\r\n

\r\n Identifying and remediating software and implementation vulnerabilities that leave sanctioned APIs exposed to attacks

\r\n

\r\n \r\n These are all essential practices, and there are some excellent resources — such as the OWASP API Security Top 10 — that provide a high-level roadmap for finding and eliminating API vulnerabilities.…