What changed in Application Programming Interface (API) Security Requirements Guide V1R1V1R1 changes

Check text

ReviewConfirm that the API documentationenforces andaccess interviewcontrol theusing APIapproved administrator. Reviewauthorization APImethods, datasuch protectionas requirementstoken-based mechanisms (e. Identifyg., APIOAuth resources2.0, thatJWT), requirerole-based protectionaccess andcontrol authentication(RBAC), overattribute-based andaccess abovecontrol the(ABAC), authenticationor requiredpolicy-based todecisions accessprovided theby APIa centralized authorization service. Ensure Thisthe canconfiguration bealigns accesswith toDOD aZero URL,Trust folder,Reference file,Architecture process,Capability orAuthorization databaseEnforcement, recordwhich requires that shouldsystems onlyvalidate beaccess availablerequests tousing certaindynamic individuals. Identifyand thecontextual accessauthorization controldecisions methodsrather usedthan byrelying thesolely APIon tostatic controlpermissions accessor tonetwork the resourcelocation. ExamplesReview includesystem Role-Baseddocumentation, AccessAPI Controlgateway policiesconfigurations, (RBAC).Usingand RBACauthorization aspolicies anto example,verify usethat aaccess testcontrol accountdecisions placedare: - intoBased aon testreal-time role. Setevaluation aof protectionuser controlidentity, onrole, adevice resourceposture, and explicitlyother denyattributes. - accessApplied toconsistently theacross roleall assignedAPI toendpoints. - theLogged testfor accountauditing and accountability. TryIf tothe accessAPI andoes APInot resourceimplement thatDOD-approved, iscontext-aware notauthorization configuredmechanisms toas allowrequired access.under AccessZero shouldTrust beCapability denied. Ifor configuredif accessauthorization restrictionsenforcement areis not enforceddocumented or configured, this is a finding.

Fix text

Build or configure the API to enforce access control using DOD-approved authorization mechanisms. Ensure that authorization decisions are dynamic and based on contextual factors (e.g., user role, device compliance, request attributes). Update system documentation to APIreflect resourcesthe authorization strategy and verify integration with access management and logging systems to meet Zero Trust Capability requirements.

V-274507 in V1R1

Check text

Verify the API enables monitoring and alerts:. 1.Confirm Checkthat the API documentationlogs forsecurity-relevant monitoringevents features. 2.and Testthat APIalerts keyare behaviorconfigured withfor normalabnormal andor anomalysuspicious conditions. 3.activity, Inspectin APIaccordance logswith fororganization-defined usagelogging trackingand alerting standards. 4. If Verifymonitoring rateis limitingnot andenabled, alertslogs workare asnot expected. 5.collected, Checkor APIalerts codeare not generated for loggingevents mechanisms. Ifas auditdefined recordsby areorganizational notpolicy beingor generatedstandards, this is a finding.

V-274517 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify both successful and unsuccessful authentication/authorization attempts to access privileges are setconfigured to be logged. This may include user identity, timestamps, access attempts, and outcomes (success or failure). Perform various test cases to simulate both successful and unsuccessful access. After performing the test scenarios, access the logs generated by the API Gateway (or the centralized logging system) and check for entries related to authentication and authorization. Cross-check the actual logging behavior with the organization’s auditing and security policies to verify the API Gateway meets required standards for logging successful and unsuccessful access attempts. If the API Gateway does not generate audit records when successful/unsuccessful attempts to access privileges occur, this is a finding.

V-274519 in V1R1

Check text

Verify both successful and unsuccessful authentication/authorization attempts to access privileges are setconfigured to be logged. This may include user identity, timestamps, access attempts, and outcomes (success or failure). Perform various test cases to simulate both successful and unsuccessful access. After performing the test scenarios, access the logs generated by the API (or the centralized logging system) and check for entries related to authentication and authorization. Cross-check the actual logging behavior with the organization’s auditing and security policies to verify the API meets required standards for logging successful and unsuccessful access attempts. If the API does not generate audit records when successful/unsuccessful attempts to access privileges occur, this is a finding.

V-274520 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify the API Gateway generates audit records of what type of events occurred. 1. Inspect the API Gateway's configuration settings and verify logging is enabled and audit records are being generated for key events such as authentication, authorization, data access, and errors. 2. Make a valid API request and verify successful events are logged. 3. Simulate system errors by causing the API to fail under specific conditions (e.g., database unavailability, timeout errors, internal exceptions). 4. Check the audit or access logs in the API Gateway or logging platform (e.g., AWS CloudWatch, Splunk, ELK stack). Verify the logs contain entries for the triggered events. 5. Inspect the log entries for the following: - Event Type: The event’s description or category (e.g., authentication attempt, data access, system error). If the API Gateway does not generate audit records for the type of event, this is a finding.

V-274522 in V1R1

Check text

Verify the platform provides features to monitor API key usage, including tracking requests made with each key and flagging anomalies such as unusualunexpected usagerequest patterns, usage from unusual geographic locations, abnormal request rates, or access to unauthorized endpoints. If API key usage is not being monitored for anomalies, this is a finding.

Fix text

Build or configure the API to monitor theAPI key usage ofand flag anomalies: Enable Logging: Log all API keyskey usage, including timestamps, IP addresses, endpoints accessed, and request rates. Define Normal Behavior: Establish a baseline for expected usage patterns (e.g., typical request rate, endpoints used, geographic regions). Set Thresholds: Configure thresholds for detecting anomalies such as excessive requests, access to unusual resources, or use from unexpected locations. Integrate Monitoring Tools: Use API management or SIEM tools to analyze logs and trigger alerts on anomalous activity. Automate Alerts: Set up real-time notifications or automated actions (e.g., temporary blocking) when anomalies are detected.

V-274523 in V1R1

Check text

Verify the API generates audit records of what type of events occurred. 1. Inspect the API’s configuration settings and verify logging is enabled and audit records are being generated for key events such as authentication, authorization, data access, and errors. 2. Make a valid API request and verify successful events are logged. 3. Simulate system errors by causing the API to fail under specific conditions (e.g., database unavailability, timeout errors, internal exceptions). 4. Check the audit or access logs in the API or logging platform (e.g., AWS CloudWatch, Splunk, ELK stack). Verify that the logs contain entries for the triggered events. 5. Inspect the log entries for the following: - Event Type: Look for the event’s description or category (e.g., authentication attempt, data access, system error). If the API does not generate audit records for the type of event, this is a finding.

V-274524 in V1R1

Check text

Verify the API audits rate-limiting events. 1. Access the API configuration to ensure rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 10001,000 requests per hour). 2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions. 3.The After triggering rate-limiting events, check the API’'s audit or access logs.log Entriesentries should: - Indicate when a rate limit was exceeded. - Include details about the API key or user who exceeded the limit. - Provide the rate-limiting threshold (e.g., "rate limit exceeded: 10001,000 requests per hour"). - Mention the specific API endpoint that was accessed. 43. Test the API to ensure that it behaves correctly when a rate limit is exceeded. For example, the API should return an appropriate status code (e.g., HTTP 429 Too Many Requests). 5. Review the organization’'s security policies to ensure rate-limiting events are properly audited as per requirements. If the API is not auditing rate limiting events, this is a finding.

V-274525 in V1R1

Check text

VerifyIf thean API Gateway auditsis ratenot limitingin eventsuse, this is Not Applicable. 1. Access the API Gateway’'s configuration to verify rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 1000 requests per hour). 2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions. 3. After triggering rate-limiting events, check the API’'s audit or access logs. Entries should: - Indicate when a rate limit was exceeded. - Include details about the API key or user who exceeded the limit. - Provide the rate-limiting threshold (e.g., "rate limit exceeded: 1000 requests per hour"). - Mention the specific API endpoint that was accessed. 4. Test the API to verify it behaves correctly when a rate limit is exceeded. For example, the API should return an appropriate status code (e.g., HTTP 429 Too Many Requests). 5. Check the API Gateway logs to determine if the gateway logs rate-limiting events properly, including identifying when the threshold is exceeded and what actions are taken (e.g., temporary block). 6. Review the organization’'s security policies to ensure rate-limiting events are properly audited as per requirements. If the API Gateway is not auditing rate limiting events, this is a finding.

V-274526 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify the API Gateway audits authentication and authorization information. 1. Confirm audit logging is enabled for authentication and authorization events. This includes both successful and failed authentication attempts, as well as the authorization decisions (e.g., whether a user is granted or denied access). 2. Verify the logs capture relevant authentication and authorization details. 3. After performing tests, review the logs for entries related to authentication and authorization. Ensure that logs contain the appropriate level of detail (e.g., timestamps, user IDs, status codes). If the API Gateway does not audit authentication and authorization information, this is a finding.

V-274527 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify the API Gateway audits exceptions and errors that occur during the processing. 1. Inspect the API Gateway logs to ensure they capture exception and error events, including error codes, messages, and stack traces. 2. Simulate errors (e.g., invalid requests or server failures) and verify these are logged with relevant details like timestamps and error types. 3. Verify the API Gateway is configured to log exceptions and errors with sufficient detail for troubleshooting and analysis. 4. Review the API Gateway documentation support to ensure proper auditing of exceptions and errors is enabled. If the API Gateway does not audit exceptions and errors, this is a finding.

V-274529 in V1R1

Check text

Verify the API audits exceptions and errors that occur during the processing. 1. Inspect the API’'s logs to ensure they capture exception and error events, including error codes, messages, and stack traces. 2. Simulate errors (e.g., invalid requests or server failures) and verify these are logged with relevant details like timestamps and error types. 3. Ensure the API is configured to log exceptions and errors with sufficient detail for troubleshooting and analysis. 4. Review the API’'s documentation support to ensure proper auditing of exceptions and errors is enabled. If the API does not audit exceptions and errors, this is a finding.

V-274530 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify the API Gateway audits execution time and performance metrics. 1. Inspect the API Gateway's logs to verify they capture performance-related data, such as execution times, request latency, and throughput. 2. Simulate various requests and monitor the execution times, verifying performance metrics are logged for each request or operation. 3. Verify the API Gateway is configured to log execution times and track key performance metrics, including thresholds for alerts. 4. Review the API Gateway’'s documentation to ensure auditing of execution time and performance metrics is properly configured and operational. If the API Gateway is not auditing execution time and performance metrics, this is a finding.

V-274531 in V1R1

Check text

Verify the API audits execution time and performance metrics. 1. Inspect the API’'s logs to ensure they capture execution times, request latency, and other performance metrics. 2. Simulate various requests and verify execution time and performance metrics are logged correctly. 3. Verify the API is configured to track and log performance data, including response times and throughput. 4. Review the API’'s documentation to ensure execution time and performance auditing is enabled. If the API is not auditing execution time and performance metrics, this is a finding.

V-274532 in V1R1

Check text

If an API Gateway is not in use, this is Not Applicable. Verify the API audits execution time and performance metrics. 1. Inspect the API Gateway’'s logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes. 2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome. 3. Verify the API Gateway is configured to log the necessary request and response details, such as the type of request, request parameters, and response status. 4. Review the API Gateway’'s documentation to ensure proper auditing of request and response details is enabled. If the API Gateway is not auditing request and response detail, this is a finding.

V-274533 in V1R1

Check text

Verify the API audits request and response details. 1. Inspect the API’'s logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes. 2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome. 3. Verify the API is configured to log the necessary request and response details, such as the type of request, request parameters, and response status. 4. Review the API’'s documentation to ensure proper auditing of request and response details is enabled. If the API is not auditing request and response detail, this is a finding.

V-274534 in V1R1

Title

The APIll must defined all the API elements musthat arbe in docusmented.

Check text

To identify APIs in use: Analyze application code for API calls, URLs, and authentication keys in frontend and backend components. Use network monitoring tools to capture API traffic in real time. Check browser DevTools (Network tab) for active API requests in web applications. Review server and API gateway logs (e.g., AWS CloudWatch, Nginx logs) to track API calls and usage patterns. Inspect configuration files, environment variables, and documentation for references to external or internal APIs. If theany alldefined the API elements inor usetheir security-relevant configurations are not defineddocumented and identifiedenforced in accordance with the organization's approved security baselines, this is a finding.

Fix text

Update the documentation accordingly.to Ensureinclude all defined API elements inand usetheir aresecurity-relevant beingconfigurations. Ensure each element is properly logged and monitored in accordance with the organization's approved security baselines.

Discussion

IdentifyingAll alldefined API elements thatand musttheir besecurity-relevant loggedconfigurations ismust essentialbe fordocumented security, monitoring, and threat detection. API logs provide detailed insights into request originsenforced, authenticationensuring methods,compliance responsewith statuses,the andorganization's potentialapproved anomaliessecurity baselines. Identifying Byall loggingAPI elements suchthat asmust APIbe keys,logged tokens,is IPessential addressesfor security, request payloadsmonitoring, and errorthreat responses,detection. organizations Documenting can detect and mitigateenforcing unauthorizedsecurity-relevant accessconfigurations attempts,for abuse,all ordefined injectionAPI attacks.elements Withoutensures comprehensive loggingconsistency, securityreduces breaches may go unnoticedmisconfigurations, makingand itsupports difficultcompliance towith respondorganizational tosecurity threats effectivelybaselines. LoggingThis alsopractice enablesenhances trackingsystem ofintegrity, APIsimplifies usage patternsaudits, helpingand identifyhelps suspiciousprevent activitiesvulnerabilities likecaused rateby limitundocumented violations or bruteinsecure forceAPI attacks before they escalate into major security incidentsbehaviors.

V-274537 in V1R1

Title

API keys must be configured with usavge restrictions specified.

Check text

VerifyReview everythe API Keykey usedconfigurations. inIf theany applicationAPI haskeys restrictionslack specifieddefined bothusage forrestrictions the applications (e.g., mobile app, IP address) andfiltering, theendpoint setaccess oflimitations, APIsand whereenvironment theyscoping) can be used. If an API key does not have restrictions, this is a finding.

Fix text

BuildUpdate or configure the API key configurations to haveinclude restrictionappropriate forusage applicationsrestrictions (limiting access by IP address, allowed endpoints, request methods, and whereenvironment theyscope) canin beaccordance usedwith organizational defined standards.

V-274556 in V1R1

Check text

VerifyReview the API limitsdocumentation theand exposure of endpointsconfiguration. 1. APIsIf canany expose admin panels or debugging endpoints. Check: https://api(i.examplee.com/debug https://api.example.com/admin https://api.example.com/internal If, theseURLs areor accessiblepaths withoutthat authentication,handle theclient APIrequests) isare improperlypublicly exposed. 2.accessible Callingwithout a protectedvalid endpointbusiness withoutor credentials: curlsecurity -Xjustification, GETor https://api.example.com/admin Ifif itunnecessary returnsendpoints sensitiveare dataexposed, the endpoint is exposed and this is a finding.

Discussion

Exposing too many API endpoints, which are specific URLs or paths that allow clients to interact with various functions or data within the system, increases the attack surface,. makingThis exposure makes the API more vulnerable to unauthorized access, data breaches, and distributed denial-of-service (DDoS) attacks. RestrictingBy restricting access ensuresto that only necessary endpoints, the API ensures that only authenticated, and authorized users can interactreach with sensitive data or critical functionsoperations. Additionally,Limiting limitingthe number of exposed endpoints reduces system complexity, improvesenhances performance, and helpsenables enforcemore effective enforcement of rate limits and monitoring more effectivelycontrols.

V-274557 in V1R1

Check text

Review the API documentation and interview the API administrator to determine access methods to the API. Attempt to access the API and confirm that an approved DOD enterprise ICAM solution is required for an external client to establish initial access to the API. Authentication of subsequent calls to the API may be accomplished using a time-limited credential such as an API key or JWT. If the API does not use an approved DOD enterprise ICAM solution for external clients to establish initial access, this is a finding.

Discussion

To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. This is typically accomplished via the use of a user store, which is either local (OS-based) or centralized (LDAP) in nature. However, DoDIDODI 8520.03 now requires that applications use an approved DOD enterprise (E-ICAM) solution whenever the ICAM solution addresses information system needs. Where the ICAM solution has been evaluated and found to not meet the needs of information system owners, information system owners must reevaluate decisions to use locally managed solutions and transition to DOD enterprise ICAM solutions to the maximum extent possible as the enterprise ICAM solutions mature.

V-274559 in V1R1

Title

The API must protect Session IDs via encryption.

Check text

Verify the API protects Session IDs. Review the API documentation and configuration. Interview the API administrator and obtain implementation documentation identifying system architecture. Identify the API communication paths. This includes system-to-system communication and client-to-server communication that transmit session identifiers over the network. Have the API administrator identify the methods and mechanisms used to protect the API session ID traffic. Acceptable methods include SSL/TLS both one-way and two-way and VPN tunnel. The protections must be implemented on a point-to-point basis based upon the architecture of the API. For example, a web API hosting static data will provide SSL/TLS encryption from web client to the web server. More complex designs may encrypt from API server to API server (if applicable) and API server to database as well. If the API session IDs are unencrypted across network segments, this is a finding.

Discussion

AuthenticityEncrypting protectionSession providesIDs protectionprotects againstthem man-in-the-middlefrom attacks/interception and unauthorized access, preventing session hijacking and ensuring the insertionconfidentiality ofand falseintegrity informationof intouser sessions.

V-274600 in V1R1

Check text

This requirement is applicable only to devices that use a web interface for device management. Verify the API keys are securely generated using a FIPS-validated RNG. Review the API documentation and interview the API administrator. Identify the cryptographic modules utilized by the API for key generation. Identify the cryptographic service provider utilized by the API and reference the NIST validation website to ensure the algorithms utilized are approved. http: https://csrc.nist.gov/groupsprojects/STM/cmvp/documents/140cryptographic-1/140valmodule-allvalidation-program.htm If the API does not use a FIPS 140-3-approved RNG, this is a finding.

Fix text

This requirement is applicable only to devices that use a web interface for device management. Build or configure the API to use FIPS 140-3-validated cryptographic modules when the API implements RNGs for key generation.

Discussion

Sequentially generated session IDs can be easily guessed by an attacker. Employing the concept of randomness in the generation of unique session identifiers helps to protect against brute-force attacks to determine future session identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. The DRBGs Hash_DRBG,(Deterministic HMAC_DRBG,Random andBit CTR_DRBGGenerators) are recommendedcryptographic foralgorithms usethat withgenerate RNGs.random-looking Thisbits requirementusing isa applicabledeterministic toprocess devicesseeded thatwith usehigh-quality aentropy. webThe interfaceDRBGs Hash_DRBG, HMAC_DRBG, and CTR_DRBG are recommended for deviceuse managementwith RNGs.

V-274603 in V1R1

Check text

Verify that the API implementation uses FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of API keys. Review theIf APInon-FIPS-validated documentationalgorithms andare interview the API administrator. Identify the data processed by the API and the accompanying data protection requirements. Determine if the data owner has specified stored data protection requirements. Determine if the API is processing publicly releasableused, CUI, or classified stored data. Determine if theencryption/hashing API configuration information contains sensitive information. Access the data repository and have the API administrator, API developer or designer identify the data integrity and confidentiality protections utilized to protect stored data. If the API processes classified data or if the data owner has specified data protection requirements and the API administrator is unable to demonstrate how the data is protectedabsent, this is a finding.

V-274606 in V1R1

Check text

Review the API architecture documentation and identify solutions that provide API DoS protections. Verify the API employs throttling to limit the effects of information flooding attacks. This includes: - requestsRequests per second. - slidingSliding window algorithm. - requestRequest queues. - reduceReduce parallelism and call frequency. If the API does not employ throttling to limit the effects of information flooding attacks, this is a finding.

V-274612 in V1R1

Check text

IdentifyReview APIs that provide privileged functionality. Verify access tocontrols for API privileged features and functions are(administrative restricted. Ifoperations, configuration management, data modification, and access to APIsensitive privilegedinformation). If featuresunauthorized andusers functionscan areaccess notany restrictedof tothese authorizedprivileged accesscapabilities, this is a finding.

Fix text

Build or configure the API to restrictImplement and enforce access tocontrols that restrict privileged API features and functions (administrative actions, configuration changes, data modification, and sensitive data access) to authorized users only.

V-274643 in V1R1

Check text

Verify the API has a mechanism for cache invalidation when using cache policy data. It may be appropriate to allow microservices to cache policy data; however, this cache must only be relied upon when an access server is unavailable. andThe cached data must expire after a duration defined by the organization and appropriate for the specific environment/infrastructure. If the API is not configured to expire cache policy data, this is a finding.

Discussion

Temporarily storing (caching) information like access control rules or system configuration policies in memory or a local store allows the system to avoid repeatedly querying a centralized policy engine or database. This makes the system faster and more resilient to outages. Caching policy data helps improve performance, reduce latency, and maintain system resilience. It is essential to carefully manage the consistency of cached data, ensure it is up-to-date, and implement mechanisms for cache invalidation when policies change.

V-274677 in V1R1

Title

The API must configure tokens when stateless authentication tokens are used.When stateless authentication tokens are used, the API must configure them with appropriate security settings.

Check text

Verify the API configures tokens with the appropriate security settings, when stateless authentication tokens are used. 1. The token expiry times must be as short as possible since they determine the duration of the session and an active session cannot be revoked. If an expiration time is not configured in accordance with organizational defined limits, this is a finding. 2. The token secret key must not be a part of the library code; it must be a dynamic variable represented by an environmental variable or specified in an environment data file. Check if the token/ secret is included in requests that originate from the library. If a token secret key is part of library code, this is a finding. 3. The key value must be stored in a data vault solution. Check Applicationapplication configuration files. Check Environmentenvironment variables referencing vault storage. If a key value is not stored in a data vault solution, this is a finding.

Fix text

Build or configure thetokens APIfor tokensstateless accordingauthentication to organizationallyensure secure validation, prevent unauthorized access, and maintain integrity without relying on server-side sessions. 1. Configure expiration time in accordance with organizational defined limits. 2. Configure the token secret key to be a dynamic variable represented by an environmental variable or specified in an environment data file. 3. Store the key value in a data vault solution.

V-274678 in V1R1

Title

API access tokens must be configured witho a lifetxpimre of 30 minutes.

Check text

Verify API access tokens are configured to expire withinaccording 30to minutesorganizational defined parameters. If API access tokens are not configured to expire withinaccording 30to minutesorganizational defined parameters, this is a finding.

Fix text

Build or configure API access tokens to expire waccordithing 30 minutes of coreganizational defined parameters.

V-274680 in V1R1

Title

API refresh tokens must be configured witho a lifetxpimre of 90 days.

Check text

Verify API refresh tokens are configured to expire withinaccording 90to daysorganizational defined parameters. If API refresh tokens are not configured to expire withinaccording 90to daysorganizational defined parameters, this is a finding.

Fix text

Build or configure API refresh tokens to expire waccordithing 90 days tof coreganizational defined parameters.

V-274681 in V1R1

Title

The API keys must havenforce per-client rate limits configured.

Check text

APIsReview providethe documentationAPI thatgateway, includesreverse detailsproxy, onor rateservice limitsconfiguration forto APIconfirm keys.that Torate determinelimiting ifis APIimplemented keyson havea rateper-client limitsbasis. configured,A look"client" formay termsbe likeidentified "rateusing limits"API keys, "quota"OAuth tokens, orIP "usageaddresses, limits"or inother theunique documentationidentifiers. InspectVerify API Responsesthat: - RateEach Limitclient Headers: Informationhas inan theindependent responserate headerslimit (e.g., requests per second/minute/hour). - X-RateLimit-LimitLimits (maximumare allowedenforced requests)consistently across API endpoints. - X-RateLimit-RemainingClients exceeding the limit receive appropriate error responses (remaininge.g., requestsHTTP in429 theToo currentMany windowRequests). - X-RateLimit-ResetThe rate limiting configuration aligns with organizational performance and security policies. Acceptable evidence may include Gateway/service configuration files or dashboards (whene.g., theAWS API Gateway, NGINX). API documentation defining rate limitlimits willper reset)client. Logs showing enforcement of limits for individual clients. If the API keysdoes do not haveenforce per-client rate limits set, or quotasif orlimits usageare limitsglobal, documentedimproperly configured, or unenforced, this is a finding.

Fix text

Build or configure per-client rate limiting on the API tousing seta gateway, reverse proxy, or API management platform. Identify clients using unique identifiers (such as API keys, access tokens, or IP addresses) and configure rate limits to ensure fair usage and prevent abuse. Ensure that: - Each client has a defined threshold for APIrequest Keysrates. - Limits are enforced dynamically. - Clients exceeding limits receive appropriate error responses. Update system documentation to reflect the implemented rate-limiting policy and enforcement mechanisms.

Discussion

IfConfiguring cachedrate authenticationlimits informationon isAPI outkeys helps prevent abuse, mitigates denial-of-service dateattacks, theand validityensures fair usage of resources by restricting the authenticationnumber informationof mayrequests bean questionableentity can make within a set timeframe.

Rule version

SRG-APP-00024007-API-000870

CCIs

CCI-002100795

V-274682 in V1R1

Title

Clients must be configured to makeroute requests tothrough a single API gateway endpointthat enforces the association and transmission of organization-defined security attributes with each request.

Check text

Note: The authorizing official (AO) may doconduct a risk assessment if not using an API Gateway. Check Client API Endpoints: Examine the client-side code (whether a web app, mobile app, or another service) to confirm that all API calls are configured to point to a single gateway URL. Review the access logs or traffic logs of the API gateway to determine where incoming requests are coming from. Verify all requests are originating from the expected single API gateway endpoint. If anythe directAPI requestsis not configured to backendroute servicesrequests arethrough founda single, authorized API Gateway endpoint, this is a finding.

V-274697 in V1R1

Check text

Note: The authorizing official (AO) may doconduct a risk assessment if not using an API Gateway. VerifyThe the API ismust utilizingbe routed through a gateway that enforces protections against denial-of-service (DoS) attacks such as rate limiting, request throttling, and anomaly detection in accordance with organization-defined thresholds. If the API does not use a gateway, this is a finding.

V-274707 in V1R1

Check text

Verify the amount of data returned by the API is restricted. Check API endpoints: Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories). If excessivelythe API exposes unusually large amountsvolumes of data arein beinga exposedsingle response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Fix text

Ensure API responses are small and contain only the data necessary for the client’'s request. To ensure that the amount of data returned by an API is appropriately restricted, implement and test measures like pagination, field filtering, query parameters, server-side limits, and proper access control.

V-274709 in V1R1

Check text

Verify the API uses TLS version 1.2 at a minimum. Review the API documentation and interview the API administrator. Identify API clients, servers and associated network connections including API networking ports. Identify the types of data processed by the API and review any documented data protection requirements. Identify the API communication protocols. Review API documents for instructions or guidance on configuring API encryption settings. Verify the API is configured to enable encryption protections for data in accordance with the data protection requirements. If no data protection requirements exist, ensure all API data is encrypted. If the API does not utilize TLS or another approved encryption mechanism to protect the confidentiality and integrity of transmitted information, this is a finding.

Fix text

Build or configure all of the API systems to require TLS (version 1.2 or higher) for all communication encryption in accordance with data protection requirements.

V-274710 in V1R1

Check text

Review the organizationAPI's identificationtoken andissuance authenticationprocess, policyspecifically onfor how access tokens must be restricted by audience(e.g., TheJWTs policy must define how tokens are intended to be used only by specific APIs or servicesOAuth2 and identify acceptable audiences (aud valuestokens). ExamineInspect the code or identity provider configuration responsible for generating access tokens. Verify that it includes the correct aud (audience) claim corresponding to the intended recipient service or API, as outlined in the policy. Authenticate to obtain access tokens forto differentverify usethat cases.it Decodeis thepresent tokensand (e.g.,correctly JSONpopulated Webwith Tokens [JWTs]) and inspect the audintended claimaudience identifier(s). Confirm Verify that theaudience claimrestrictions accuratelyalign identifieswith the specificorganization's APIidentification or service the token is meant for and alignsauthentication with policy. Try, usingensuring anthat accesstokens tokenare issuedscoped foronly one API (aud = Service A) to callauthorized aAPIs, different API (Service B). The receiving API should reject the token if it does not match the expected audienceservices, confirmingor enforcement of audience restrictionclients. Review theaccess tokencontrol and validation codelogic or middleware in the API. Verifyor thatresource itserver explicitlyto checksensure thethat audincoming claimtokens againstare itsvalidated ownagainst identifier and denies access if the claimexpected doesaudience not matchvalue. ExamineInterview auditthe orsystem accessowner logsor developer to verify thathow tokens with incorrect or missing audience claimsvalues are rejecteddefined, and recorded appropriatelyissued, supporting accountability and policy complianceenforced. ConfirmIf thataccess APItokens and identity provider settings are documentednot andaudience-restricted correctlyor setif tothe issue and enforce audience restrictionsvalues baseddo onnot organizationalcomply guidelines. Ifwith anythe misconfigurationsorganization-defined are identifiedpolicy, this is a finding.

V-274712 in V1R1

Check text

Verify the API uses parameterized queries. Review the API's documentationsource andcode interviewor thebackend APIdatabase administratorinteraction layer. IfIdentify workingall withdatabase thequeries developer,constructed requestusing documentationuser-supplied on their development processes and what their standard operating procedure is for sanitizing all API input. IdentifyVerify thethat latestparameterized vulnerabilityqueries scan(also results. Reviewknown theas scanprepared resultsstatements) andare scanused configurationinstead settings. Verifyof thedynamically scanconstructed wasSQL configuredstrings towith identify input validation vulnerabilitiesconcatenation. IfConfirm thethat scanquery resultsparameters detectedare highbound riskusing vulnerabilities, verify a more recent scan shows remediation of the vulnerabilitiesappropriate ismethod available for examination. Review any risk acceptance documentation that indicates the informationlanguage systemor securitydatabase officerframework (ISSO)e.g., has?, reviewednamed andparameters, acceptedor thebind riskvariables). If theany vulnerabilityqueries scanuse isstring notconcatenation configuredor tointerpolation testof foruser input validationwithout vulnerabilities if the most recent scan results show that high risk input validation vulnerabilities exist and a documented risk acceptance from the ISSO is not availableparameterization, or if the scan results do not exist, this is a finding.

V-274714 in V1R1

Check text

Verify the API provides input validation. Review the API documentation and interview the API administrator. IfReview working with the developer,API's requestinput documentationhandling onmechanisms theirat developmentall processesexposed andendpoints. Identify whatall theirpoints standardwhere operatinguser procedureinput is foraccepted, sanitizingincluding allquery APIparameters, input. Identifyheaders, thebody latestcontent, vulnerability scan results. Review the scan results and scanpath configuration settingsvariables. Verify thethat scan was configured to identify input validation vulnerabilities. Ifis theimplemented scanto resultsenforce detectedexpected highformats, riskdata vulnerabilitiestypes, verifyranges, aand more recent scan shows remediation of the vulnerabilities is available for examinationlengths. ReviewEnsure anyvalidation riskoccurs acceptanceon documentation that indicates the informationserver systemside, securityregardless officerof (ISSO)any hasclient-side reviewed and accepted the riskchecks. IfCheck thefor vulnerabilityvalidation scanagainst isknown-safe notpatterns configuredor towhitelists test(e.g., forregex, inputenumerated validationvalues) vulnerabilitiesand ifproper therejection mostof recentmalformed scanor resultsunexpected showinput. If that high risk input validation vulnerabilities exist and a documented risk acceptance from the ISSO is notmissing, availableinsufficient, or ifonly theenforced scanon resultsthe doclient not existside, this is a finding.is is a finding.

V-274715 in V1R1

Check text

Verify the API is configured to use a WAF or API Gateway to manage traffic. If the API is not configured to use a WAF or API Gateway toin manageaccordance trafficwith organization-defined security policies, this is a finding.

Discussion

The API gatewaysmust andbe firewallsprotected actby asa intermediaries,Web filteringApplication outFirewall malicious(WAF) trafficor an API Gateway that monitors and providingfilters centralizedincoming managementand outgoing traffic to prevent injection attacks, whichensuring enhancesmalicious securityinputs are detected and blocked.

V-274769 in V1R1

Discussion

FIPS 140-2/140-3 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2/140-3 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2/140-3 standard. The cryptographic module used must have at least one validated digital signature function. This validated hash algorithm must be used to generate digital signatures for all cryptographic security function within the product being evaluated.

V-274783 in V1R1

Check text

Verify API services identified within the system as unnecessary and/or nonsecure are disabled. Review the API documentation and configuration. Interview the API administrator. Identify the services, network ports, and protocols used by the API. Using a combination of relevant OS commands and API configuration utilities, identify the services and TCP/IP port numbers the API is configured to use and is using. Review the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) at: https://cyber.mil/ppsm/cal/. Verify the ports used by the API are approved by the PPSM CAL. If the ports and services are not approved by the PPSM CAL, this is a finding.

V-274785 in V1R1

Check text

Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases. If the API is not configured to provide protected storage for API keys, this is a finding.

Fix text

Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.

V-274830 in V1R1

Check text

Verify the API uses a circuit breaker pattern to handle failures and timeouts. Review the API documentation or the system’'s architecture documentation. The pattern might be explicitly mentioned as part of the API’'s design to handle failures and timeouts. If a circuit breaker pattern is not being used, this a finding.

V-274835 in V1R1

Check text

To check if cryptographic keys that protect access tokens are properly protected in an API: 1. Verify a proper key management system (KMS) is in place to generate, store, and rotate cryptographic keys. 2. Verify that keys are generated and stored using best practices, ensuring they are never exposed in plaintext. 3. Verify keys are stored securely. 4. Verify keys are not hardcoded in application code or exposed in configuration files. 5. Review who and what services have access to the cryptographic keys. Verify only authorized users or services (e.g., API services) have access to them. 6. Verify key rotation procedures are in place, and cryptographic keys are rotated regularly to mitigate the risk of key compromise. 7. Confirm that any access to or usage of cryptographic keys is logged and auditable. This should include who accessed the key, when, and for what purpose. 8. Review the API’'s documentation to ensure that cryptographic keys are managed and protected according to security guidelines (e.g., NIST, FIPS). If cryptographic keys are not properly protected, this is a finding.

V-274839 in V1R1

Check text

To check if the API protects the private keys used to sign assertions and tokens: Verify private keys used for signing tokens and assertions are stored securely. These keys must not be hard coded in the codebase or stored in plaintext files. Verify private keys are stored in a secure location such as a hardware security module (HSM) or key management service (KMS), which provides encryption and access control. Verify only authorized personnel or systems can access the keys. Review filesystem permissions. Verify that the private keys are encrypted both at rest and in transit. If using cloud-based key management systems, ensure that encryption is enabled by default. Verify private keys are only used for their intended purpose—signing tokens and assertions. Audit the system to ensure that keys are only accessible during token generation or signing processes and not left accessible longer than needed. Confirm that there is a key rotation policy in place for the private keys used to sign tokens and assertions. These keys should be rotated regularly to reduce the risk of compromise. Implement monitoring and logging mechanisms to audit any access to, or use of, private keys. Logs must capture who accessed the key, when, and for what purpose. Review the API’'s or key management system’'s documentation to confirm private key protection practices align with industry standards, such as NIST guidelines and FIPS compliance. If the API is not protecting private keys, this is a finding.

V-274840 in V1R1

Check text

Review the API’'s authentication and authorization mechanisms. Ensure that the assertions are generated using the correct identity source's identity provider (IdP). Verify the API adheres to the defined authentication standards to ensure only authenticated and authorized entities can generate assertions. Check the assertions include necessary identity information (e.g., user ID, roles, and claims) and are signed or encrypted. Verify the generation process is compliant with any guidelines regarding assertion lifetime, scope, and audience. Review system logs to confirm the API is correctly implementing the authentication policies and generating assertions only after successful identity verification. Consult the organization’'s identity management documentation and compare it to the API’'s implementation to ensure full alignment with the defined policies. If the API is not generating assertions in accordance with organization-defined identification and authentication policy, this is a finding.

Fix text

Build or configure the API to generate assertions in accordance with organization-defined identification and authentication policy.

V-274841 in V1R1

Check text

Reviewing the API’'s authentication and authorization mechanisms. Verify the assertions are issued using the correct identity source's identity provider (IdP). Verify the API adheres to the defined authentication standards to ensure that only authenticated and authorized entities can issue assertions. Check the assertions include necessary identity information (e.g., user ID, roles, and claims) and are signed or encrypted. Validate the issued process is compliant with any guidelines regarding assertion lifetime, scope, and audience. Check that the API enforces rules for assertion expiration, audience restrictions, and security measures like encryption or digital signatures, ensuring assertions cannot be tampered with or misused. Consult the organization’'s identity management documentation and compare it to the API’'s implementation to ensure full alignment with the defined policies. If the API is not issuing assertions in accordance with organization-defined identification and authentication policy, this is a finding.

V-274842 in V1R1

Check text

Check if the API refreshes assertions in accordance with the organization-defined identification and authentication policy. Review the API’'s handling of assertion expiration and renewal. Ensure the API follows the organization’'s defined policies for assertion lifetime, including the duration before assertions need to be refreshed or reissued. Check if the API requires reauthentication or uses a secure refresh mechanism, such as refresh tokens or secure revalidation processes, to generate new assertions when they expire. Verify the process for refreshing assertions maintains security standards, including proper encryption, secure token storage, and validation of the refreshed assertions before they are issued. Review the API’'s implementation to confirm it adheres to the organization’'s authentication policy for refreshing, ensuring that refreshed assertions include up-to-date identity information and relevant claims, and that they are properly scoped. Test the API by requesting new assertions after expiration and examining whether they are refreshed securely and according to policy, ensuring compliance with the organization’'s standards for identity management and authentication. If the API does not refresh assertions in accordance with organization-defined identification and authentication policy, this is a finding.

Discussion

An API must refresh assertions to maintain secure, uninterrupted access while ensuring that authentication and authorization remain valid over time. Assertions, such as JWTs or SAML tokens, often have expiration times to reduce the risk of misuse if compromised. By implementing a mechanism to refresh these assertions—typically using refresh tokens or re-authentication flows—the API can issue new assertions without requiring the user to log in repeatedly. This not only enhances user experience by supporting seamless sessions but also strengthens security by periodically re-evaluating the user’'s credentials and access rights. Refreshing assertions ensures that access remains both valid and aligned with any changes in user roles, permissions, or session status.

V-274843 in V1R1

Check text

Verify that the API has an implemented and functional revocation mechanism. This could involve endpoints or methods that allow for the invalidation of assertions, such as a revocation list or a central system for tracking revoked assertions. Simulate the revocation of assertions by either manually revoking access or simulating scenarios that trigger revocation (e.g., a user’'s session being terminated, access being revoked due to a policy violation). Ensure the API properly invalidates the assertions and prevents further access with the revoked assertions. Review Logging and Auditing of Revocation Events: Confirm that the API logs revocation events, capturing key details such as who initiated the revocation, when it occurred, and why it was revoked. After revocation, test that any attempt to use the revoked assertion is properly rejected by the API. The API should deny access if the assertion has been invalidated, ensuring no further use is possible. Refer to the API’'s documentation to confirm that revocation processes are correctly implemented in line with the organization’'s defined policies for identity management and authentication. If the API does not revoke assertions in accordance with organization-defined identification and authentication policy, this is a finding.

V-274844 in V1R1

Check text

Reviewing the organization’'s identification and authentication policy's defined rules for assertion validity duration. This should include the maximum lifespan of assertions, such as the allowed expiration time after issuance. Check the API's implementation to ensure it generates assertions with the correct expiration times based on the organization’'s policy. Assertions must include expiration claims (e.g., exp in JWT tokens), and the API must enforce these time restrictions automatically. Simulate the use of assertions at different times, including immediately after issuance and near expiration. Ensure the API correctly rejects assertions that have expired or are no longer valid according to the defined time restrictions. Verify the API is applying time-based policies for issuing or renewing assertions. For example, it should not issue assertions with a duration that exceeds the time limits set by the organization. It should also handle scenarios like late requests that could fall outside the permitted time window. Review the API logs to verify expiration and time-based events are being properly logged, including when an assertion is created, expired, or rejected due to time constraints. Refer to the API’'s documentation to ensure the time restriction policy is implemented correctly and compliant with the organization’'s defined standards for assertion time management. If the API does not time restrict assertions in accordance with organization-defined identification and authentication policy, this is a finding.

V-274845 in V1R1

Check text

Review the organization’'s identification and authentication policy to understand the specific audience restrictions defined, including which entities or systems are allowed to consume the assertions and how audience claims are handled. Check the API’'s implementation to verify assertions include proper audience claims (e.g., aud in JWT tokens). The audience claim must specify which entity or service is permitted to use the assertion, in accordance with the organization’'s policy. Simulate the use of assertions by different services or users to verify the API correctly enforces audience restrictions. The API must reject any assertion that is not intended for the current consumer or service, based on the audience claim. Verify the audience values specified in the assertions align with the organization’'s policy. Check that the API logs events related to audience validation, including successful and failed attempts to access protected resources based on audience restrictions. These logs must be detailed enough to identify when audience-related validation occurs and whether access was granted or denied. If the API relies on third-party identity providers (IdPs) or other systems for generating assertions, verify these systems correctly implement audience restriction policies. Test the integration between these systems and the API to verify that audience-restricted assertions are being correctly issued and consumed. Review the API’'s documentation to confirm audience restrictions are implemented correctly, and ensure the API is fully compliant with the organization’'s defined audience control policies. If the API does not audience restrict assertions in accordance with organization-defined identification and authentication policy, this is a finding.

V-274846 in V1R1

Check text

Review the organization’'s identification and authentication policy to understand requirements for access token generation, including allowed token types, token claims, encryption/signature requirements, and conditions under which tokens may be issued. Examine the API or authentication server code/configuration responsible for token issuance. Verify it enforces authentication of clients or users before issuing a token and that it includes required attributes (e.g., subject ID, roles, scopes) based on the policy. Generate tokens using valid authentication requests and inspect their structure and contents. Confirm the issued tokens include the proper claims, are correctly signed/encrypted, and match the formatting (e.g., JWT) required by policy. Attempt to obtain tokens under various conditions, including successful and failed login attempts, and with different scopes or resource requests. Confirm tokens are only issued in compliance with authentication success and policy-based restrictions. If the API uses an identity provider (IdP) or API Gateway for token generation, review those configurations to verify they enforce organizational policies during token issuance. If the API does not generate access tokens in accordance with organization-defined identification and authentication policy, this is a finding.

V-274847 in V1R1

Check text

Review the code, configuration or identity provider responsible for issuing tokens. Verify it enforces the required authentication procedures and that tokens are not issued without proper user or client validation. Perform a valid authentication flow to receive an access token. Examine the token to ensure it includes required fields like sub (subject), aud (audience), exp (expiration), iat (issued at), and any scopes or roles defined by policy. Attempt to obtain tokens using invalid credentials, insufficient authentication methods, or unauthorized client requests. Confirm the API does not issue access tokens in these cases, in alignment with the policy. Check that the token is signed or encrypted using the approved cryptographic algorithms. Ensure keys are securely managed and that tokens cannot be tampered with. Verify that the token’'s expiration time matches what the policy defines. Ensure short-lived tokens are used where required, especially for sensitive or high-risk data access. Review API or identity provider documentation to confirm whether token issuance behavior aligns with organizational requirements. If any misconfigurations are identified, this is a finding.

V-274848 in V1R1

Check text

Review the API or authorization server's refresh token endpoint logic. Confirm that it validates the refresh token, checks expiration, and enforces any associated conditions like device binding or client verification. Simulate valid and invalid refresh scenarios. Use an active refresh token to obtain a new access token and confirm that the new token includes required claims, is properly signed, and has an appropriate expiration time. Verify the refresh process enforces client authentication, restricts token reuse (e.g., one-time-use refresh tokens if required), and aligns with the cryptographic and authentication strength. Examine the newly issued access tokens to verify they include correct fields like exp, iat, aud, and scope, and that their validity periods are consistent with the organization’'s guidelines. Consult the API or identity provider documentation and configuration to verify refresh behavior is implemented in accordance with the defined organizational standards. If any misconfigurations are identified, this is a finding.

Discussion

An API must refresh access tokens to maintain secure, uninterrupted access while minimizing the risk of token misuse or expiration. Access tokens typically have a limited lifespan and refreshing them allows users to maintain active sessions without needing to re-authenticate. If the API is not relying on an API Gateway for token management, it becomes responsible for issuing and refreshing tokens directly, ensuring that users can continue to interact with the API seamlessly, while also enforcing up-to-date authentication. By implementing token refresh, the API can validate the user’'s ongoing permissions, reduce the risk of session hijacking, and prevent users from being locked out due to expired tokens, all while maintaining a stateless, scalable approach to security.

V-274849 in V1R1

Check text

Examine the organization's identification and authentication policy required lifespan of access tokens. This includes default expiration times, any conditions for shorter or longer durations, and rules for different user roles or access levels. Review the code or configuration responsible for generating access tokens to ensure it sets the exp (expiration) and iat (issued at) claims according to policy. Confirm that tokens are not issued with excessively long lifetimes unless explicitly allowed. Authenticate and obtain access tokens under various scenarios (e.g., user login, system-to-system access). Decode the tokens (e.g., if JWT) and check the exp and iat fields to verify the validity period aligns with the organization’'s defined rules. Wait until a token expires and attempt to use it with the API. Confirm the API correctly rejects expired tokens with appropriate error responses (e.g., HTTP 401 Unauthorized or 403 Forbidden). Determine whether the API adjusts token lifespans based on risk factors, user roles, or sensitivity of requested resources. This must also comply with the organizational policy. Ensure the API validates the exp claim on each request and denies access to expired tokens. Look into API or identity provider configuration files to confirm that token timeout values match policy-defined thresholds. If any misconfigurations are identified, this is a finding.

V-274851 in V1R1