<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure API Architecture — API Reference

## agent.js CLI

```bash
# Audit OpenAPI spec for security issues
node scripts/agent.js --action audit --spec openapi.yaml

# Generate API security policy
node scripts/agent.js --action policy --output api-policy.json

# Validate gateway configuration
node scripts/agent.js --action validate --gateway kong
```

## Kong Gateway CLI

```bash
# Add rate limiting plugin
curl -X POST http://localhost:8001/services/api/plugins \
  -d "name=rate-limiting" -d "config.minute=100" -d "config.policy=redis"

# Add key-auth plugin
curl -X POST http://localhost:8001/services/api/plugins \
  -d "name=key-auth" -d "config.key_names=X-API-Key"

# Add request size limiting
curl -X POST http://localhost:8001/services/api/plugins \
  -d "name=request-size-limiting" -d "config.allowed_payload_size=1"

# Add CORS plugin
curl -X POST http://localhost:8001/services/api/plugins \
  -d "name=cors" -d "config.origins=https://app.example.com"
```

## AWS API Gateway CLI

```bash
# Create usage plan with throttling
aws apigateway create-usage-plan --name "Standard" \
  --throttle '{"burstLimit":50,"rateLimit":100}' \
  --quota '{"limit":10000,"period":"DAY"}'

# Enable WAF on API Gateway
aws wafv2 associate-web-acl --web-acl-arn WAF_ARN --resource-arn API_ARN
```

## OWASP API Security Top 10 (2023)

| ID | Risk | Mitigation |
|----|------|------------|
| API1 | Broken Object Level Authorization | Object-level access checks |
| API2 | Broken Authentication | Strong auth, token validation |
| API3 | Broken Object Property Level Authorization | Schema validation, field filtering |
| API4 | Unrestricted Resource Consumption | Rate limiting, pagination |
| API5 | Broken Function Level Authorization | RBAC enforcement |
| API6 | Unrestricted Access to Sensitive Business Flows | Bot detection, CAPTCHA |
| API7 | Server Side Request Forgery | URL validation, allowlists |
| API8 | Security Misconfiguration | Hardened defaults, no debug |
| API9 | Improper Inventory Management | API catalog, versioning |
| API10 | Unsafe Consumption of APIs | Validate third-party responses |
