Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Application Programming Interface (API) Security Requirements Guide

The Application Programming Interface (API) Security Requirements Guide (V1 R1) has 65 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

65STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R1

CurrentPublished Thu Sep 11 2025 What changed in V1R1

API must use a circuit breaker pattern to handle failures and timeouts.

Application Programming Interface (API) Security Requirements Guide

Assessment Title

Rule Text

Description

Discussion Text

A circuit breaker pattern is essential in APIs to prevent cascading failures and improve system resilience. It monitors API calls and temporarily blocks requests when failures reach a threshold, allowing the system to recover before retrying.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-274835

Rule

SV-274835r1143875_rule

Severity

medium

Rule Version

SRG-APP-000945-API-001635

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the API uses a circuit breaker pattern to handle failures and timeouts.

Review the API documentation or the system's architecture documentation. The pattern might be explicitly mentioned as part of the API's design to handle failures and timeouts.

If a circuit breaker pattern is not being used, this a finding.

Implementation Procedure

Fix Text

Configure the API to use a circuit breaker pattern to handle failures and timeouts.

STIG check 52 of 65 in the Application Programming Interface (API) Security Requirements Guide checklist

← Previous · V-274830The API must provide protected storage for API keys.Next · V-274839 →Cryptographic keys that protect access tokens must be protected.