FFIEC IT Examination Handbook DAM-IV.I.2: IV.I.2 API Risk Mitigation (Development, Acquisition, and Maintenance)

Management mitigates the common API risks: extra authorisation checks at the object level against broken object-level authorisation, validated user authentication suited to the API's use with multifactor authentication considered, security settings kept appropriate with APIs patched and unnecessary functions disabled, developer review of API responses so that only the data needed are exposed, and the further mitigations the booklet lists for resource consumption, function-level authorisation, mass assignment, injection, asset management and logging.