Knowing every API you expose, and enforcing what it should accept

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

APIShield runs at the TotalHeal edge in front of your API hosts: it learns endpoints from traffic, imports your OpenAPI description, enforces the schema when you are ready and reports API abuse — enumeration, mass assignment, missing authentication — as findings.

2The challenge

APIs now carry most application traffic, and the classic attacks on them — reading other customers’ records by changing an ID, sending fields the client should not set, calling forgotten endpoints — look like ordinary requests to a web firewall.

The TotalHeal approach. APIShield runs at the TotalHeal edge in front of your API hosts. It learns the endpoints from traffic, imports your OpenAPI description, enforces the schema when you are ready and reports API abuse patterns as findings.

3Architecture

4How it works

1. DiscoverEndpoints learned from traffic, with first and last seen.
2. ImportUpload your OpenAPI 3.x description.
3. CompareShadow and zombie endpoints, and findings for review.
4. EnforceReject non-conforming requests when you are ready.

5Capabilities in detail

• API inventory from trafficMethods, path templates, parameters, content types, whether authentication was seen and response codes, with first-seen and last-seen dates.
• Shadow and zombie endpointsEndpoints in traffic but not in your specification, and endpoints in the specification that nobody calls.
• OpenAPI importUpload an OpenAPI 3.x description or point to its URL.
• Schema enforcementReject requests that break the imported or approved schema — detect first, block when you decide.
• Abuse findingsUnauthenticated access to endpoints that usually carry authentication, object-ID enumeration from one client, unexpected body fields (mass assignment) and excessive data in responses — shown as findings, not automatic blocks.
• Sensitive data, counted not storedResponses are flagged for personal-data patterns such as phone, e-mail, Aadhaar-format and PAN-format values; only counts are kept, never the values.

6Security and data handling

• Detect firstEnforcement is switched on by you, never by default.
• Counts, not valuesSensitive-data flags keep counts only.
• Findings, not surprisesHeuristics never block on their own.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• The TotalHeal edge in front of your API host (TotalHeal point of presence or a self-hosted edge node)

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.