With runtime API inventory, the Cequence Unified API Protection (UAP) platform assembles a complete view, internal and external, of the API endpoints within your organization. The Cequence UAP platform presents that information in a comprehensive Runtime Inventory dashboard, along with detailed sub-screens for further investigation.
What the Runtime Inventory dashboard can tell you
The Cequence UAP platform's Runtime Inventory dashboard summarizes the following information:
- Total number of API endpoints, listing API endpoints that were active or inactive within a specified time period, as well as the total number of endpoints.
- Total number of API transactions over time, enabling you to gauge how much API traffic is being analyzed to discover the runtime API endpoints.
- Risk level assessment for all API endpoints in the inventory, showing any potential weaknesses in your API risk posture.
- API endpoints with sensitive data.
- API endpoints categorized by authentication type, risk exposure level, or access type -- internal, external, or third-party.
You can select a specific aspect from any panel in the dashboard to investigate that aspect in greater depth.
The Runtime Inventory analysis includes common API risks such as the top ten OWASP vulnerabilities, among others, and is regularly updated to address new threats discovered by public researchers in the security field as well as internal findings of vulnerabilities encountered by Cequence.
How the Runtime Inventory classifies your APIs
The Cequence UAP platform classifies the APIs in your organization with the help of several elements that you define.
The first element is a list of domains that you specify as being controlled by your organization. The second element is a list of IPv4 address ranges that you specify as being internal to your organization.
When an API is hosted on a domain that your organization controls and the calls to that API originate from one of the IPv4 address ranges you've specified as internal, the Cequence UAP classifies that API as Internal.
When an API is hosted on a domain that your organization controls but receives calls from IPv4 address ranges outside of the ranges that you've specified as internal, the Cequence UAP classifies that API as External.
The Cequence UAP platform classifies APIs that do not match either of the previous conditions as Third-party.
Dashboard
The following excerpt from a sample Runtime Inventory dashboard shows how the Cequence UAP platform displays and categorizes API endpoint information.
Going into the API inventory shows a list of endpoints with summary information about each endpoint displayed, including the risk level, specific behaviors such as being an unsecured API or containing sensitive information, and the specific hostname for the endpoint.
You can add labels to specific endpoints, specify rules to determine the scope of internal, external, or third-party APIs and configure rules for endpoint parameterization from this dashboard.
Click an endpoint to examine that endpoint in detail, including what requests and responses for that API look like. These details also include the causes of a given risk assessment and detailed recommendations on how to address those risks.