TotalHealDatasheet · 27 October 2026
TotalHealAPIShield
API Security
Protect API hosts at the same edge that runs WebShield: discovery, schema enforcement and API abuse findings.
- Cloud (SaaS)
- Hybrid
- On-premises
- Air-gapped
The challenge
APIs now carry most application traffic, and the classic attacks on them — reading other customers’ records by changing an ID, sending fields the client should not set, calling forgotten endpoints — look like ordinary requests to a web firewall.
The answer
APIShield runs at the TotalHeal edge in front of your API hosts. It learns the endpoints from traffic, imports your OpenAPI description, enforces the schema when you are ready and reports API abuse patterns as findings.
- Status
- Available
- Deploys as
- Cloud (SaaS) · Hybrid · On-premises · Air-gapped
- Runs on
- SaaS; Self-hosted edge node
- Priced per
- API host per year
- Trial
- 30 days
- Licence
- Sold on its own; one TotalHeal console
Supported platforms
- Any HTTP(S) APIOpenAPI 3.x
- Edge nodex86_64, aarch64, systemd
How it works
- DiscoverEndpoints learned from traffic, with first and last seen.
- ImportUpload your OpenAPI 3.x description.
- CompareShadow and zombie endpoints, and findings for review.
- EnforceReject non-conforming requests when you are ready.
Reference architecture
Key capabilities
- API inventory from trafficMethods, path templates, parameters, content types, whether authentication was seen and response codes, with first-seen and last-seen dates.
- Shadow and zombie endpointsEndpoints in traffic but not in your specification, and endpoints in the specification that nobody calls.
- OpenAPI importUpload an OpenAPI 3.x description or point to its URL.
- Schema enforcementReject requests that break the imported or approved schema — detect first, block when you decide.
- Abuse findingsUnauthenticated access to endpoints that usually carry authentication, object-ID enumeration from one client, unexpected body fields (mass assignment) and excessive data in responses — shown as findings, not automatic blocks.
- Sensitive data, counted not storedResponses are flagged for personal-data patterns such as phone, e-mail, Aadhaar-format and PAN-format values; only counts are kept, never the values.
Deployment options
Cloud (SaaS)AvailableNo production point of presence with high availability yet.
HybridAvailableThe installer stays locked until the release key is published.
On-premisesAvailableDelivered with our team from the on-premises kit.
Air-gappedAvailableOffline kit, offline licence file and offline update bundles.
System requirements
Protected platforms
- Any HTTP(S) APIOpenAPI 3.x
- Edge nodex86_64, aarch64, systemd
On-premises server
- Operating system
- RHEL, Rocky Linux or AlmaLinux 8 / 9; Ubuntu 20.04, 22.04 or 24.04; Debian 11 / 12
- Processor
- 4 vCPU (tested configuration)
- Memory
- 8 GB recommended (6 GB minimum)
- Disk
- 10 GB free for software, releases and backups, plus data
- Sign-in
- Active Directory / LDAP, SAML 2.0 or OpenID Connect
- Software
- Nothing to pre-install: no container runtime, database, web server or Java
Network and access
- The TotalHeal edge in front of your API host (TotalHeal point of presence or a self-hosted edge node)
Alerts and tickets to
- Splunk
- Microsoft Sentinel
- Elastic
- Syslog / CEF
- Jira
- ServiceNow
- Slack
- Microsoft Teams
Technical specifications
| Features | Included | ||
|---|---|---|---|
| API inventory from traffic | Included | ||
| Shadow and zombie endpoints | Included | ||
| OpenAPI import | Included | ||
| Schema enforcement | Included | ||
| Abuse findings | Included | ||
| Sensitive data, counted not stored | Included | ||
| Availability by tier | Essential | Professional | Elite |
| API inventory from traffic: methods, path templates, parameters, content types, authentication seen, response codes; OpenAPI export | Included | Included | Included |
| Sensitive data in responses counted, never stored (phone, e-mail, Aadhaar and PAN formats) | Included | Included | Included |
| OpenAPI 3.x import, shadow and zombie endpoints, endpoint review | — | Included | Included |
| Schema enforcement — detect first, block when you decide | — | Included | Included |
| Self-hosted edge nodes in your data centre | — | Included | Included |
| Abuse findings: unauthenticated access to endpoints that usually carry it, object-ID enumeration from one client; accept or reopen | — | — | Included |
| List price per API host per year | US$2,400 · ₹2,28,380 | US$6,000 · ₹5,70,960 | US$12,000 · ₹11,41,920 |
| Platforms and coverage | |||
| SaaS | Any API over HTTP(S) behind the TotalHeal edge: verify the domain, point a CNAME at the edge | ||
| Self-hosted edge node | Linux with systemd, x86_64 or aarch64 | ||
| Console | TotalHeal web console | ||
| Deployment options | |||
| SaaS (CNAME to the TotalHeal edge, India) | AvailableNo production point of presence with high availability yet. | ||
| Hybrid (self-hosted Linux edge node) | AvailableThe installer stays locked until the release key is published. | ||
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. | ||
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. | ||
| Licensing | |||
| Priced per | API host per year | ||
| Counted | API hosts configured at the edge | ||
| Trial | 30 days | ||
| Government profile | Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks. | ||
| Procurement dossier | Compliance matrix, bill of materials, architecture and hardening, SLA and OEM authorisation letter, on request | ||
| On-premises server | |||
| Operating system | RHEL, Rocky Linux or AlmaLinux 8 / 9; Ubuntu 20.04, 22.04 or 24.04; Debian 11 / 12 | ||
| Processor | 4 vCPU (tested configuration) | ||
| Memory | 8 GB recommended (6 GB minimum) | ||
| Disk | 10 GB free for software, releases and backups, plus data | ||
| Sign-in | Active Directory / LDAP, SAML 2.0 or OpenID Connect | ||
| Software | Nothing to pre-install: no container runtime, database, web server or Java | ||
| Requirements | |||
| Requirement 1 | The TotalHeal edge in front of your API host (TotalHeal point of presence or a self-hosted edge node) | ||