Standard
API Security Standard
This standard defines the minimum security controls for every API the organization produces, exposes, or consumes. It covers REST, GraphQL, gRPC, WebSocket, and event-driven APIs. It applies whether the API is internal, partner-facing, or public.
- Type
- Standard
- Version
- 0.0.14
- Date
- 2026-10-15
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- Annual and upon material change to API portfolio, threat-pattern, or platform-native posture
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Lifecycle gates
- 4. Authentication
- 5. Authorization
- 6. Input validation and output handling
- 7. Transport and message security
- 8. Rate limiting, quotas, and abuse prevention
- 9. Logging, monitoring, and observability
- 10. API gateway and management
- 11. Third-party API consumption
- 12. AI-exposed APIs
- 13. GraphQL-specific controls
- 14. Event-driven and webhook APIs
- 15. Operating expectations
- 16. Framework alignment
- 17. Limitations
Frameworks it maps to
- OWASP API Security Top 10 (2023)
- OWASP ASVS v5
- NIST SP 800-204
- NIST SP 800-204D
- ISO/IEC 27001:2022
- NIST SP 800-95
- RFC 6749, 7519, 8725, 9068
- OpenID Connect Core 1.0
- FAPI 2.0
- CSA Cloud Controls Matrix v4.1
Related documents
- Secure Development and Engineering Policydev-security
- Developer Security Requirementsdev-security
- DevOps Security Requirementsdev-security
- Software Composition Analysis Standarddev-security
- Quality Assurance and Testing Standarddev-security
- Identity and Access Management Policysecurity
- Encryption and Key Management Policysecurity
- Logging and Monitoring Standardsecurity
- Data Loss Prevention Standardsecurity
- Zero Trust Architecture Frameworksecurity
- AI Access and Agent Permissions Standardai
Next
All Documents