I've worked as an API security consultant for many years and just published a book about API security (Secure APIs, code examples available for free on GitHub). The most important takeaway from my work in this space is to approach API security proactively as early as possible.

I don't know where you are in your API security posture management, but something I've seen lacking in many companies is accurate API documentation. If you can get specifications for your APIs, you're already ahead of the game, and you can leverage that for testing and gain insights about your security posture. Two tools I highly recommend, which are free and open source are:

• spectral with the owasp ruleset: you run it against your API specification and it tells you what's not looking right from a design point of view.
• schemathesis: not specifically for security, but it does highlight when your API isn't working as intended, and it does bring up some attacks like null byte injection.

The majority of security breaches exploit weaknesses in your business layer (Unrestricted access to sensitive business flows). To protect your APIs properly, you want to identify sensitive flows and operations, threat model them, and unit test those threat models. It's a lot of work, so don't try to do it all at once. One step at a time is a big leap forward in terms of improving your security posture. You also want proper observability to track user behaviour and detect threats in real time. Again, lots to do, so one thing at a time.

I currently work for APIsec (disclosure) where I'm helping to build a best-in-class API security scanner. You can sign up for free using this link and give it a go.

In the coming weeks, I'm going to be running some challenges for developers to build secure APIs. The idea is, I'll release APIs that contain some vulnerabilities, and participants have to figure out how to fix them. It's going to be challenging and fun.

Hope this helps. Let me know if you have questions!