Date Published: May 18, 2026
Comments Due:
Email Questions to:
Author(s)
Ramaswamy Chandramouli (NIST), Zack Butcher (Tetrate)
Announcement
A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. These Web APIs are the most prevalent API type. Their inherent simplicity, universal compatibility with browsers, robust ecosystem of developer tools, and superior caching efficiency align with existing web infrastructure to provide scope for introducing vulnerabilities and accompanying threats of exploitation.
This document:
- Analyzes threats to RESTful APIs across the pre-runtime and runtime phases
- Provides guidelines for implementing a set of controls to mitigate threats
- Complement the detailed set of controls provided in SP 800-228 by including parameters that are specific to the architectural style of RESTful Web APIs
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. This alignment with Web is the reason they are also called Web APIs and remain the most prevalent API type. Their inherent simplicity (creating a low barrier for entry), universal compatibility with browsers, robust ecosystem of developer tools and superior caching efficiency that aligns naturally with existing web infrastructure gives scope for introducing vulnerabilities and accompanying threats of exploitation. This document analyzes those threats to RESTful APIs and provides guidance for implementing a set of associated mitigating controls. Thus, it also complements the detailed set of controls provided in SP 800-228 by including parameters that are specific to the architectural style of RESTful Web APIs.
A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. This alignment with Web is the reason they are also called Web APIs and...
See full abstract
A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. This alignment with Web is the reason they are also called Web APIs and remain the most prevalent API type. Their inherent simplicity (creating a low barrier for entry), universal compatibility with browsers, robust ecosystem of developer tools and superior caching efficiency that aligns naturally with existing web infrastructure gives scope for introducing vulnerabilities and accompanying threats of exploitation. This document analyzes those threats to RESTful APIs and provides guidance for implementing a set of associated mitigating controls. Thus, it also complements the detailed set of controls provided in SP 800-228 by including parameters that are specific to the architectural style of RESTful Web APIs.
Hide full abstract
Keywords
API; API endpoint; API gateway; API key; API schema; web application firewall
Control Families
None selected
