Security Logging, Detection & Incident Response — API Security in Depth

Log security-relevant events with actor, tenant, action, object, outcome, IP/user agent and request ID: logins, token issuance, permission changes, key creation/revocation, admin actions, authorization failures, rate-limit hits. Never log secrets or tokens (redact). Build detections: spikes in 401/403/404 on object routes (BOLA probing), one key from many countries, mass data downloads. Prepare runbooks — leaked key: revoke, rotate, assess usage from logs, notify.

Detections and responses

Detection	Signal	Response
BOLA probing	Many 404/403 across sequential/random IDs by one principal	Throttle, alert, review
Credential stuffing	High failed-login rate across accounts from many IPs	Step-up, block ASN, notify users
Leaked API key	Secret-scanning alert or unusual geography	Revoke, rotate, audit usage
Data exfiltration	Unusual volume of list/export calls	Rate limit, suspend, investigate
Privilege change	Role grants outside change process	Alert security, verify

{
  "ts": "2026-10-11T09:14:03.120Z", "event": "api_key.revoked",
  "actor": {"type": "user", "id": "u_42"}, "tenant": "t_7",
  "target": {"type": "api_key", "id": "key_9f", "last4": "Q2xZ"},
  "outcome": "success", "ip": "203.0.113.9", "request_id": "req_7Hq2…"
}

SENSITIVE = {"authorization", "cookie", "x-api-key", "password", "token", "secret"}

def redact(d: dict) -> dict:
    return {k: ("[REDACTED]" if k.lower() in SENSITIVE else redact(v) if isinstance(v, dict) else v)
            for k, v in d.items()}

Common pitfalls

Tokens or full card numbers in logs.
Audit logs that admins can edit.
No runbook for leaked credentials.

Key points

Structured, immutable audit events
Detections for probing and abuse
Runbooks for key leaks

Further reading: OWASP Logging Cheat Sheet

Practice questions

What pattern in logs suggests BOLA probing?

Answer

A single principal generating many 403/404 responses on object routes with varying IDs in a short time.

What are the first steps when an API key leaks publicly?

Answer

Revoke/rotate it immediately, review its usage logs for abuse, notify affected parties, and fix how it leaked (secret scanning, storage).