PRODUCTS / API SECURITY

API security

Protect API workloads with custom rules, granular Layer 7 rate limits, and trusted upstream signals — without pushing every decision into application code.

API policy pipeline

Rule → Limit → Signal → Origin

API requests can be matched by route, header, method, query string, client IP, and named headers before approved traffic reaches your application.

Rules

match logic

Limits

L7 control

Signals

origin headers

Custom rules for API workloads

Layer your own match logic on top of managed packs: require an API key header, block admin paths from the public internet, or enforce geo- and IP-specific policies using the same expression language as managed rules.

API-specific controls

Require API key header

Enforce required authentication or routing headers at the edge.

Block admin paths

Keep admin and private paths away from the public internet.

Geo policy

Apply location-specific allow, block or challenge logic.

IP policy

Use IP and CIDR logic with the same expression language.

Granular rate limits

Stop abuse at Layer 7 with granular rate limits scoped to how APIs actually work.

Per IP + URL path

Protect login, checkout, and search endpoints.

Per IP + query string

Control enumeration and scraping attempts.

Composite keys

Mix IP, path, HTTP method, and named headers.

Composite-key example

Cap POST to /api/login per IP independently of GET traffic. Scope any limit with optional match conditions so only suspicious traffic counts toward the threshold.

Exceeded limits trigger block, challenge, or captcha.

Upstream signals on allow

Approved requests can carry extra headers to your origin — flagging verified humans, API tiers, or WAF disposition — so the application layer can make informed decisions.

Signals forwarded to your app

Verified humans

Pass trust state to the origin when traffic is verified.

API tiers

Forward plan, tenant, or tier context for downstream logic.

WAF disposition

Share allow, challenge, or policy outcome with the app.

No app redeploy

Shift policy at the edge while your codebase stays untouched.