API security is software that finds every API a company's website and apps use, and protects those APIs from misuse while they are running. An API is a set of requests that one program can send to another. For example, a mobile app may send the request "give me the details of policy number 4471203" to the company's server. The server replies with the policy holder's name, phone number and address.
Almost every modern app works through APIs. The app on your phone draws the screen, but it asks the company's servers for every piece of data through an API. So the APIs are where the data is, and attackers now target them heavily.
The most common API weakness is simple. The server checks that the user is logged in, but not that the requested record belongs to that user. So a logged-in user can change the policy number in the request and receive another customer's details. This weakness is called broken object level authorisation, or BOLA. It is at the top of the OWASP API Security Top 10, a widely used list of the most critical API security risks.
API security does three jobs. First, it builds a list of every API. It reads a copy of the traffic from the API gateway or the load balancers. It often finds APIs that nobody had listed, such as an old version that was never switched off. These are called shadow APIs. Second, it learns how each API is normally used. Third, it raises an alert, or blocks the user, when the use is abnormal.
Consider a two-wheeler insurance app based in Pune. One logged-in account starts asking for policy details. In one hour, the same account requests 9,000 different policy numbers, one after another. A normal customer asks for one or two, their own. Each single request looks normal, so a web application firewall (WAF) lets it pass. A WAF looks for known attack patterns inside each request. API security looks at the pattern across many requests. It sees one account reading thousands of other people's records, and it blocks the account. It also tells the security team that this API does not check who owns each policy. Under India's data protection law, the DPDP Act, a leak of these records would be a personal data breach. From 13 May 2027, the company must report such a breach to the Data Protection Board of India and to each affected customer. Already today, CERT-In's rules require the company to report a data leak to CERT-In within 6 hours of noticing it.
API security also works before an app goes live. Penetration testing and DAST attacks the API on purpose, to find such flaws first. The flaws found are sent to application security posture management (ASPM), which tells developers which ones to fix first.