API Security in Depth · API Threat Landscape & Object-Level Risks
Threat Modeling an API
STRIDE per endpoint, trust boundaries and abuse cases.
Before testing, model threats. Draw the data flow: clients, gateway, services, data stores, third parties, and the trust boundaries between them. For each endpoint ask STRIDE questions, list abuse cases ("as an attacker I want to read other tenants' invoices"), and map them to controls and tests. Re-run the model when endpoints change — make it part of design review, not a yearly exercise.
STRIDE applied to APIs
| STRIDE threat | API example | Control |
|---|---|---|
| Spoofing | Stolen/forged token | Strong auth, token validation, mTLS for services |
| Tampering | Modified price in request | Server-side authority, signatures, validation |
| Repudiation | 'I never cancelled that' | Audit logs with actor, time, request ID |
| Information disclosure | Leaky fields, verbose errors | Response schemas, generic errors |
| Denial of service | Expensive queries, floods | Limits, quotas, timeouts |
| Elevation of privilege | User calls admin function | Deny-by-default authorization |
Abuse case record
endpoint: GET /v1/tenants/{tenantId}/invoices/{invoiceId}
assets: [invoice PDF, customer PII]
abuse_cases:
- id: AC-1
as: authenticated user of tenant A
want: read invoices of tenant B by changing tenantId/invoiceId
control: tenant + ownership check in repository query
test: tests/security/test_invoice_bola.py::test_cross_tenant_denied
- id: AC-2
as: anonymous attacker
want: enumerate invoice IDs
control: auth required, non-sequential IDs, 404 for unauthorized
Common pitfalls
- Threat models that never reach tests.
- Ignoring internal callers (service-to-service).
- Modeling only the happy path.
Key points
- Map data flows and trust boundaries
- Write abuse cases per endpoint
- Link each control to a test
Further reading: OWASP: Threat Modeling
Practice questions
What is an abuse case?
Answer
A user story from an attacker's perspective (what they want to achieve and how), used to derive controls and security tests.
Why include internal service-to-service calls in an API threat model?
Answer
Attackers who compromise one service or exploit SSRF can call internal APIs; without authentication and authorization there, one breach spreads.
Open in the app to mark lessons complete, take notes and track your progress.