TotalHealAPIShieldAPI Security
Protect API hosts at the same edge that runs WebShield: discovery, schema enforcement and API abuse findings.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate APIShield API Security. No card.
APIs now carry most application traffic, and the classic attacks on them — reading other customers’ records by changing an ID, sending fields the client should not set, calling forgotten endpoints — look like ordinary requests to a web firewall.
APIShield runs at the TotalHeal edge in front of your API hosts. It learns the endpoints from traffic, imports your OpenAPI description, enforces the schema when you are ready and reports API abuse patterns as findings.
APIShield API Security, feature by feature.
API inventory from traffic
Methods, path templates, parameters, content types, whether authentication was seen and response codes, with first-seen and last-seen dates.
Shadow and zombie endpoints
Endpoints in traffic but not in your specification, and endpoints in the specification that nobody calls.
OpenAPI import
Upload an OpenAPI 3.x description or point to its URL.
Schema enforcement
Reject requests that break the imported or approved schema — detect first, block when you decide.
Abuse findings
Unauthenticated access to endpoints that usually carry authentication, object-ID enumeration from one client, unexpected body fields (mass assignment) and excessive data in responses — shown as findings, not automatic blocks.
Sensitive data, counted not stored
Responses are flagged for personal-data patterns such as phone, e-mail, Aadhaar-format and PAN-format values; only counts are kept, never the values.
How APIShield API Security works.
APIShield runs at the TotalHeal edge in front of your API hosts: it learns endpoints from traffic, imports your OpenAPI description, enforces the schema when you are ready and reports API abuse — enumeration, mass assignment, missing authentication — as findings.
- DiscoverEndpoints learned from traffic, with first and last seen.
- ImportUpload your OpenAPI 3.x description.
- CompareShadow and zombie endpoints, and findings for review.
- EnforceReject non-conforming requests when you are ready.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| SaaS | Any API over HTTP(S) behind the TotalHeal edge: verify the domain, point a CNAME at the edge |
| Self-hosted edge node | Linux with systemd, x86_64 or aarch64 |
| Console | TotalHeal web console |
Deployment
| Profile | Status |
|---|---|
| SaaS (CNAME to the TotalHeal edge, India) | AvailableNo production point of presence with high availability yet. |
| Hybrid (self-hosted Linux edge node) | AvailableThe installer stays locked until the release key is published. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per api host per year. Counted: aPI hosts configured at the edge.
| Feature | EssentialUS$2,400per API host per year | ProfessionalUS$6,000per API host per year | EliteUS$12,000per API host per year |
|---|---|---|---|
| API inventory from traffic: methods, path templates, parameters, content types, authentication seen, response codes; OpenAPI export | |||
| Sensitive data in responses counted, never stored (phone, e-mail, Aadhaar and PAN formats) | |||
| OpenAPI 3.x import, shadow and zombie endpoints, endpoint review | |||
| Schema enforcement — detect first, block when you decide | |||
| Self-hosted edge nodes in your data centre | |||
| Abuse findings: unauthenticated access to endpoints that usually carry it, object-ID enumeration from one client; accept or reopen |
List prices per API host per year; minimum 1 API host. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- The TotalHeal edge in front of your API host (TotalHeal point of presence or a self-hosted edge node)
Procurement documents for APIShield API Security
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal Edge Defense suite and of Complete — each product is still licensed on its own.
TotalHealWebShield
Web Application Firewall (WAF)
A web application firewall in front of your portals, tuned without breaking real users.
TotalHealTrafficShield
Bot management & L7 DDoS
Keep bots, credential stuffing and application-layer (Layer 7) floods off your sites.
TotalHealVulnSight
Vulnerability Management
Know which installed software carries a known, exploited vulnerability — without a scanner appliance.
Get a quote for APIShield API Security.
Tell us how many api hosts you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.