API Security
Discovers and protects APIs from abuse.
Overview
API security tools inventory APIs, detect misconfigurations and sensitive-data exposure, and block runtime abuse and business-logic attacks. The category grew as APIs became the dominant attack surface. Priced per API count, traffic, or environment. Often integrates with WAF and CNAPP.
Dedicated control once you run API-centric or API-heavy apps.
Advantages
- Salt/Traceable strong on discovery and runtime
- finds shadow and zombie APIs
- addresses the dominant modern attack surface.
Trade-offs
- New category with overlapping vendor claims
- opaque pricing
- needs traffic mirroring/integration
- can overlap WAF and CNAPP.
Open-source option
OSS now has a genuinely active option: Akto (MIT-licensed, self-hostable, listed below) handles API discovery and automated security testing. 42Crunch's tooling (also listed) covers OpenAPI/spec-level security with a free tier. But no self-hostable project yet matches the full runtime discovery plus always-on business-logic-abuse protection of commercial leaders like Salt Security, Traceable or Cequence. (APIClarity, the OSS option previously cited here, was archived by its maintainer and is no longer a credible pick.)
Vendors & tools in this area
OSS API traffic visibility, spec reconstruction and drift detection (OpenClarity) — repo now archived.
Visit site →Open-source API discovery and testing platform — the live alternative to the now-archived APIClarity.
Visit site →OpenAPI-spec-first API security — audits contracts, tests conformance, and deploys per-API micro-firewalls.
Visit site →