Worksheet

API security control checklist

A checklist in four groups. Inventory covers endpoints, data sensitivity and caller type, access control covers authentication plus per-record authorisation, and hardening covers input validation, secret storage and rate limiting. Operations covers safe logging, dependency updates and an incident plan, and the whole list works for reviewing a live API or scoping a new one.

Name: ______________________   Business: ______________________   Date: ______________

Scroll the table sideways to see every column.

Cross out or rewrite any heading that does not fit your business. From the guide “How to Secure Business APIs”, www.gullysystem.com/blog/how-to-secure-business-apis