> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/api-sec/intruduction.md).

# Intruduction

An API, short for **Application Programming Interface**, is a set of rules and protocols that allows one software application to interact with another. It defines the methods and data formats that applications can use to communicate with each other. APIs are essential for enabling different software systems to work together, exchange data, and perform various tasks seamlessly.

### Types of APIs:

* **REST APIs (Representational State Transfer):**

  REST is an architectural style that uses HTTP methods (GET, POST, PUT, DELETE) to interact with resources.

  It's stateless, and URLs identify resources. Responses are often in JSON or XML format.
* **GraphQL APIs:**

  GraphQL allows clients to request specific data they need using a flexible query language.

  It aggregates data from multiple sources in one request, reducing over-fetching and under-fetching.
* **SOAP APIs (Simple Object Access Protocol):**

  SOAP defines a standardized format for exchanging structured information using XML.

  It offers built-in security and error handling but can be rigid in structure.

### HTTP Request Methods:

* **GET:** Retrieve data from the server.
* **POST:** Send data to the server to create a new resource or perform an action.
* **PUT:** Update or replace an existing resource or create one if it doesn't exist.
* **PATCH:** Apply partial modifications to a resource.
* **DELETE:** Remove a resource from the server.
* **OPTIONS:** Retrieve information about the communication options for the target resource.
* **CONNECT:** Used for establishing a network connection to a resource, often with proxy
* **TRACE:** Echoes back the received request for diagnostic purposes.

### Common HTTP Requests Headers

* **Host:** Specifies the server's domain name for the request.
* **Authorization:** Includes authentication credentials for access control.
* **Content-Type:** Indicates the media type of the request or response payload.
* **User-Agent:** Identifies the client application or user agent making the request.
* **X-API-KEY:** Provides an API key for authentication and access control. Content-Length: Specifies the size of the request body in bytes.
* **Accept-Encoding:** Lists the supported encoding methods for the response.
* **X-Forwarded-For:** Indicates the original client's IP address in proxy scenarios.
* **Keep-Alive:** Suggests whether the client wants to maintain a persistent connection.

***

## API Objects

API objects, also known as resources or data models, represent the entities or data structures that an API deals with. These objects define the types of data that can be created, read, updated, or deleted through the API. For example, in an e-commerce API, API objects could include "product," "order," "customer," and "cart." API objects are used to encapsulate and represent specific pieces of data or records in the system.

Attributes or properties are associated with each API object, describing the characteristics of the object. For instance, a "product" object might have attributes such as "name," "price," "description," and "stock\_quantity." These attributes define the structure of the object.

API objects are typically organized into collections and individual instances. For instance, a collection of "products" represents all available products, while an individual "product" represents a specific item.

## API Actions

API actions, also known as HTTP methods or verbs, represent the operations that can be performed on API objects. These actions define what can be done with the data represented by API objects. The most common API actions correspond to HTTP methods:

* **POST (Create):** Used to create a new instance of an API object. For example, you can create a new "user" or "product."
* **GET (Read/Retrieve):** Used to retrieve information about an API object or a collection of objects. For instance, you can retrieve details about a specific "user" or a list of "products."
* **PUT (Update):** Used to update an existing API object or create it if it doesn't exist. You can use this action to modify an "order" or "customer" record.
* **PATCH (Partial Update):** Similar to "PUT," but used for making partial updates to an API object. For example, you might update just the "address" field of a "user" object.
* **DELETE (Delete):** Used to remove an API object. You can delete a "comment" or "product" from the system.

These actions correspond to CRUD (Create, Read, Update, Delete) operations on API objects and are defined by the HTTP standard. Each API action typically corresponds to a specific URL endpoint or route and is accompanied by a set of parameters and data in the API request.

## References

* [PortSwigger GraphQL Guide](https://portswigger.net/web-security/graphql)
* [Awesome API Security](https://github.com/arainho/awesome-api-security)
* [API Security Checklist](https://github.com/shieldfy/API-Security-Checklist)
* [API Wordlist](https://github.com/chrislockard/api_wordlist)
* [31 Days of API Security Tips](https://github.com/inonshk/31-days-of-API-Security-Tips)
* [Apisec University](https://www.apisecuniversity.com/)