Model the caller, object and action
An API should state who or what may call it, which objects they may access and which actions are permitted. Authentication proves an identity claim; authorisation still needs to evaluate ownership, role, tenant and operation for every request. Object identifiers must never become permission checks by accident.
Document trust boundaries, data classification, expected call volume and failure behaviour before implementation. Include machine identities, scheduled jobs, mobile clients and partner integrations. Decide where policy is enforced and how downstream services receive only the authority they require rather than a broad reusable token.
Protect implementation and deployment paths
Validate inputs by type, length and structure, and constrain outbound requests so user-controlled values cannot reach unexpected services. Keep secrets outside code and logs. Rate limits, quotas and resource bounds should protect availability without becoming a substitute for correct authorisation.
Use reviewed schemas, automated tests and dependency controls in the delivery pipeline. Separate development and production credentials, require approval for sensitive configuration and preserve a record of deployed versions. Security testing should include misuse cases, not only valid requests with invalid syntax.
Operate and retire APIs deliberately
Log authentication results, sensitive administrative actions, permission failures and unusual consumption with enough context for investigation. Avoid recording secrets or unnecessary personal data. Define owners for alerts and test whether evidence connects gateway, application and identity events.
Maintain an inventory of versions, consumers and dependencies. Deprecation needs communication, telemetry and a final removal decision; abandoned endpoints often retain data access after teams forget them. Revoke credentials, remove routes and verify that documentation and developer portals no longer advertise the retired interface.
What to do next.
- ✓Define subject, object and action for every operation.
- ✓Test object- and function-level authorisation.
- ✓Constrain inputs, outputs and outbound requests.
- ✓Separate credentials across environments.
- ✓Log decisions without exposing secrets.
- ✓Inventory versions and verify retirement.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.