Design Partner Program
EXPLAINER · API SECURITY

API security posture management: know every API, then prove which ones matter.

API security posture management (API-SPM) answers three questions continuously: which APIs exist, what data they handle, and how they're configured. It's the inventory every other API control depends on. This guide covers what API-SPM finds, how it differs from testing and runtime protection, and how to turn a posture backlog into fixes that matter.

API POSTURE SNAPSHOTacme-prod · illustrative
APIS DISCOVERED 463 Gateways, traffic, specs and code
UNDOCUMENTED 37 Shadow: running, not in any spec
DEPRECATED, LIVE 14 Zombie: old versions still routed
HANDLE PII 58 Classified from requests and responses
POSTURE ISSUES 214 Across auth, data, config and rate limits
PROVEN EXPLOITABLE 6 Validated with request evidence
From 463 APIs and 214 posture issues to 6 proven exploitable. That's the list engineering acts on first.
01 · WHAT API-SPM DOES

The Five Jobs of API Security Posture Management

Most API-SPM programs do the first three well. The last two are where posture turns into reduced risk.

01

Discover

Find every API from gateways, traffic, cloud config, specs and code, including undocumented and deprecated ones.

OUTPUT · A complete, current inventory.
02

Classify

Tag each API by data sensitivity, exposure, owner and business service.

OUTPUT · Context for every endpoint.
03

Assess

Check authentication, authorization config, transport, rate limits and spec drift against policy.

OUTPUT · A list of posture issues.
04

Validate

Test high-risk APIs as real identities to prove which posture issues are exploitable.

OUTPUT · Proven risk, with evidence.
05

Remediate

Route proven issues to owners and retest fixes; retire zombie versions.

OUTPUT · Fewer exploitable APIs over time.
02 · HOW IT FITS

API-SPM vs API Security Testing vs Runtime Protection

Three categories that are often bundled and often confused. Each answers a different question; mature programs use all three.

ASPECT
API posture management
API security testing
Runtime protection
Question it answers
Which APIs exist, and which look risky?
Which risks are exploitable?
Is someone attacking right now?
How it works
Observes traffic, config, specs and code
Sends crafted requests as test identities
Inspects live requests inline or out of band
When
Continuously
On release and on schedule
Every request, in production
Output
Inventory and posture issues
Validated findings with evidence
Blocks, alerts and incidents
Blind spot
Can't tell if a risk is exploitable
Only tests what it knows about
Valid-looking abuse often passes
Best paired with
Testing, to prioritize
Posture, for complete coverage
Both, for fewer false alarms

Posture tells you an API could be a problem. Testing tells you whether it is. Runtime protection tries to stop someone using it right now. Compare API testing tool types →

03 · INVENTORY EXPLORER

API Inventory: Filter by Posture, Then Sort by Proof

Ten APIs from a sample inventory. Filter by posture signal to see how quickly the list grows, then switch the sort to see what validation does to it.

API FOUND VIA DATA POSTURE SIGNALS SCORE VALIDATION
GET /health/debugpayments-svc code Secrets ShadowNo authInternet-facing 90 Blocked by control
POST /internal/exportreports-svc traffic PII ShadowNo auth 82 Unreachable
GET /api/users/searchaccounts-api gateway PII Internet-facingExcess data 71 Exploitable
POST /v1/webhooksnotify-svc traffic Internal ZombieNo auth 67 Exploitable
POST /v3/paymentspayments-svc spec PCI Internet-facingNo rate limit 63 Not exploitable
GET /admin/tenantsadmin-api code PII Shadow 59 Not yet run
GET /v1/orders/{id}orders-api (deprecated) traffic PII ZombieInternet-facing 56 Exploitable
GET /v2/orders/{id}orders-api spec PII Internet-facing 48 Not exploitable
PATCH /api/users/meaccounts-api spec PII Internet-facing 44 Exploitable
GET /partners/catalogcatalog-api gateway Public Internet-facingNo rate limit 38 Not exploitable
10 APIs shown. By posture score alone, 1 of the top 3 is actually exploitable. The highest score belongs to an API that validation shows is blocked by control. Switch to validation to see the real order.

Illustrative inventory · synthetic services · posture score 0 to 100, higher is riskier

04 · POSTURE CHECKS

API Posture Checks Worth Running Continuously

Seven categories, mapped to the OWASP API Security Top 10 (2023). Each check flags a condition; the right column says what it takes to prove it.

CATEGORY POSTURE CHECK FLAGS TO PROVE IT OWASP

Inventory

Undocumented endpoints, deprecated versions still routed, specs out of date with traffic. Call each version as real identities and compare behavior with the current one. API9

Authentication

Endpoints with no auth, weak schemes, long-lived tokens or auth only at the gateway. Request without, with expired and with other users' tokens. API2

Authorization

Object IDs in paths, missing scopes, admin routes on public hosts. Swap object IDs and roles; check for cross-user and cross-tenant access. API1 · API5

Data exposure

Responses with PII, secrets or more fields than the spec documents. Compare what each role receives against what it should. API3

Rate limiting

No limits on login, OTP, export or other sensitive flows. Exercise the flow at volume within approved limits. API4 · API6

Transport & config

Plain HTTP, permissive CORS, verbose errors, debug endpoints. Confirm each is reachable and what it reveals. API8

Third-party APIs

Outbound calls to external APIs with broad credentials or unvalidated responses. Check how the service handles malicious or unexpected upstream data. API10
05 · POSTURE PLUS PROOF

Zombie API Example: A Medium Posture Finding That Was Critical

Posture flagged /v1/orders as deprecated but still routed. It sat in a backlog of 200 similar issues. Validation showed it skipped the ownership check added in /v2.

Illustrative finding · synthetic data

orders-api /v1 · deprecated version still exploitable API9:2023 → API1:2023 · CWE-639
Medium Critical Validated
POSTURE
Flagged by posture: /v1/orders still receives traffic 9 months after /v2 launched. Severity: Medium.GET /v1/orders/{id} · last seen: 2 h ago · owner: orders team
CONTEXT
Classified as returning PII: names, addresses, order history.
VALIDATE
Requested as user_a for an order owned by user_b, on both versions.GET /v2/orders/ord_B → 404 GET /v1/orders/ord_B → 200
RESULT
The ownership check added in /v2 was never backported. Any customer can read any order through /v1. Response redacted in the evidence record.200 { "id": "ord_B", "name": "█████", "address": "█████" }
RERANK
Posture severity Medium raised to Critical on proof. Moved from position 112 to the top of the backlog.
SCOPE
Read-only requests against staging, mirrored from production routing.
Fix and retest: remove the /v1 route at the gateway and in the service; validation reruns and the endpoint returns 404 for every identity.
06 · METRICS

API Posture Metrics That Show Risk Going Down

Issue counts rise as discovery improves. Report these instead.

COVERAGE

Share of APIs with a known owner

Unowned APIs never get fixed. Track this before issue counts.

INVENTORY

Shadow and zombie APIs over time

Should fall as specs catch up and old versions are retired.

EXPOSURE

Sensitive-data APIs reachable from the internet

The population where posture issues matter most.

PROOF

Validated exploitable APIs

The number that matters to the business, and the one that should drop fastest.

SPEED

Time from posture flag to proof

How long a risky API waits before anyone knows if it's real.

FIX

Time from proof to verified fix

Measured by retest, not ticket closure.

07 · WHERE HAYROK FITS

The Validation Layer on Top of API Posture

Hayrok takes the inventory and posture findings from your gateways and API-SPM tools, tests each high-risk API as real identities, and returns which issues are exploitable with evidence. Posture tells you where to look; Hayrok tells you what to fix first.

01

Uses the inventory you have

Imports APIs and posture findings from gateways, specs and API-SPM tools.

02

Validates the riskiest first

Targets internet-facing, sensitive-data and zombie APIs before the rest.

03

Real identities

Tests as each role and tenant, so authorization issues are proven, not inferred.

04

Reranks on proof

The Risk Engine scores validated exposure 0 to 100, replacing guesswork in the backlog.

05

Evidence and retest

Each finding carries redacted request pairs and reruns until the fix is proven.

08 · FAQ

API Security Posture Management FAQ

API-SPM is the continuous practice of discovering every API an organization runs, classifying the data each one handles, and assessing configuration and design against security policy, so teams know where API risk is concentrated.

BRING YOUR POSTURE BACKLOG

Turn 200 API posture issues into the handful that are actually exploitable.

Export your API inventory and posture findings. We'll validate the highest-risk APIs against staging as real identities and hand back a proven, prioritized list with evidence.