What is an API Security?

Core controls include strong authentication (verifying who is calling), fine-grained authorization (verifying what that caller is actually allowed to do, not just that they're logged in), input validation (rejecting malformed or malicious payloads before they reach business logic), and encryption in transit via TLS. A surprising number of real-world API breaches trace back to a broken authorization check — an endpoint that correctly verifies identity but fails to verify that the identified caller should have access to the specific record being requested. Beyond the request itself, API security includes rate limiting (to blunt abuse and denial-of-service attempts), audit logging (so suspicious activity can be investigated after the fact), and never trusting client-supplied identifiers like a tenant ID over trusting the verified claim embedded in an authenticated token — the latter is what actually enforces multi-tenant isolation. For systems where an AI agent itself is calling the API — not a human clicking a UI — security also has to account for a new threat class: prompt injection that tries to trick the agent into calling an API in a way the actual user never intended, which is why tool-call authorization increasingly needs its own explicit approval layer, not just a valid credential.