Guidelines for API Protection for Cloud-Native Systems - March 2026 Update

Published

March 13, 2026

Author(s)

Ramaswamy Chandramouli, Zack Butcher

Abstract

Modern enterprise IT systems rely on a family of application programming interfaces (APIs) for integration to support organizational business processes. Hence, a secure deployment of APIs is critical for overall enterprise security. This, in turn, requires the identification of risk factors or vulnerabilities in various phases of the API life cycle and the development of controls or protection measures. This document addresses the following aspects of achieving that goal: (a) the identification and analysis of risk factors or vulnerabilities during various activities of API development and runtime, (b) recommended basic and advanced controls and protection measures during the pre-runtime and runtime stages of APIs, and (c) an analysis of the advantages and disadvantages of various implementation options for those controls to enable security practitioners to adopt an incremental, risk-based approach to securing their APIs.

Citation

Special Publication (NIST SP) - 800-228-upd1

Report Number

800-228-upd1

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.SP.800-228-upd1

Local Download

Keywords

API, API endpoint, API gateway, API key, API schema, web application firewall.

Citation

Chandramouli, R. and Butcher, Z. (2026), Guidelines for API Protection for Cloud-Native Systems - March 2026 Update, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-228-upd1, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=961660 (Accessed March 14, 2026)