What is API security?
API security is the set of protections on an application programming interface (API). It covers authenticating every caller, checking authorization on each request, validating input, and limiting abuse. The OWASP API Security Top 10 lists the most common API weaknesses.
What the buyer is really asking
The buyer is about to integrate with your API and wants to know how it is protected. Cover authentication, authorization on every request, input validation, and abuse protection. Link to your public API docs where you can.
Other ways buyers ask it
Every one of these wants the same answer:
- “Describe your API security controls.”
- “How is your API authenticated?”
- “Do you validate API input?”
Evidence to have ready
- API authentication documentation
- Authorization and input validation practices
- Rate limiting or WAF configuration
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.