Protect without a specification
Give the address of the API or load an OpenAPI file, a GraphQL schema or a proto file. ToutWAF recognises the type of API and prepares the protection.
API security
Protect an API without writing a specification: ToutWAF builds a route profile, watches it without refusing anything, shows what it would have blocked, then you switch to blocking. Tokens, keys, GraphQL limits and OWASP API Top 10 coverage complete it.
Where to find it in the console : Protection menu: API security (tabs Protect my API, OWASP coverage, Inventory, Specifications, Keys).
What it is for
Learn before refusing
In learning mode, nothing is refused. A report lists what would have been blocked, with the cause and the fix, until the profile is ready.
Know where you stand
A tab lists the ten risks of the OWASP API Security Top 10 with their state and a safe-fix button when one exists.
Control who calls and how much
JWT tokens, API keys with scopes and quotas, GraphQL limits, WebSocket limits, detection of identifier enumeration.
Protect my API in three steps
Nothing has to be typed on a server. Every step is reversible.
Your API
ToutWAF contacts only the address you give, without credentials, refuses internal addresses and recognises REST, GraphQL, SOAP, gRPC, OData, JSON-RPC, tRPC and WebSocket.
A profile in learning mode
Declared methods and paths, accepted content types, maximum request and batch size. The report « What would have been blocked » fills in as traffic arrives.
Switching to blocking
The state says when it is ready. Switching asks for confirmation and states how many requests would have been refused; « Back to learning » undoes it.
The protection building blocks
Kostenlos
They combine; the assistant switches on those that suit your API.
- Route profile: only the declared methods and paths get through, with their content types and sizes.
- JWT: signature, allowed algorithm (an unsigned token is refused), issuer, audience, expiry, JWKS keys with rotation, and key discovery from your OIDC issuer.
- API keys: scopes per method and path, per-minute quotas, rotation with a grace period; the secret is shown only at creation.
- Injections in JSON values and mass assignment are detected by the built-in detectors.
GraphQL and WebSocket
Kostenlos
Limits that prevent oversized requests.
- GraphQL: depth, aliases, batch size and complexity are limited (10, 15, 10 and 1000 by default), and introspection is blocked by default.
- WebSocket: message size, rate per connection, volume per minute and valid JSON on the paths you list; a violation closes the connection.
Identifier enumeration (BOLA and IDOR)
KostenlosPro und höher
A heuristic, not an authorization check: only your API's code knows who owns what.
- Free: an identity (key, token subject, session) that asks for too many distinct objects within a time window is flagged.
- Licence required: an identifier this client was never given, learned from JSON responses, is flagged; in detection only by default.
OWASP API Top 10 coverage
Kostenlos
Each risk is marked Protected, Partly protected or Not protected, with the checks in plain words and the findings of the last 30 days.
- The « Fix it » button switches on only controls that cannot break a normal API, and keeps a value you chose. A risk that needs a choice links to the right tab.
- The limits are written on the page: object-level authorization stays in your code, stock hoarding and content scraping are not detected, and unsafe consumption of third-party APIs never goes beyond « partial ».
- The profile exports as YAML with no secret or address, to keep next to the API's code.
API discovery
Kostenlos
On by default: the engine inventories what it sees go by.
- Observed endpoints, parameters and sensitive-data classes, merged with your imported specifications.
- An OpenAPI document can be generated from the traffic; shadow (undocumented) and zombie (unused) APIs are listed; a posture score relies on the OWASP checklist.
- A new site has no traffic yet: nothing is discovered before the first requests.
Licence required
Pro und höher
Visible in the console but locked without a licence. What is already configured keeps being enforced after expiry.
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL schema, gRPC proto file.
- « Test my protection » with harmless attacks, simulation on past traffic and profile import.
- Consumers, plans, quotas and private usage pages; limits per key or per user.
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC.
What is not done, or not proven
We prefer to say it plainly.
- Not done: AsyncAPI parsing (a document is kept but not enforced), OAuth2 token introspection and mutual TLS for partner APIs. PayPal webhooks are not supported.
- Only one specification per site is enforced. gRPC is not deeply inspected; only validation with a proto file (under licence) does it.
- JWT, API keys, the route profile and BOLA are off by default: the assistant or your settings switch them on site by site. For a WebSocket, only the messages sent by the browser are inspected.
- The assistant's checks (detection of each stack's specification address, the probes of « Test my protection », the learning report) were exercised against simulated local servers, not against a real application of each stack.
Use cases
A mobile API with no documentation
The assistant learns the routes from real traffic, the report shows the gaps, you switch to blocking when it is empty.
A public GraphQL API
Depth, aliases and complexity bounded, introspection closed, and a clear refusal for oversized queries.
An API open to partners
Keys with scopes and quotas, tokens verified against your issuer, and per-consumer plans under licence.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionKostenlos In allen Angeboten enthalten, auch in den beiden kostenlosen (Free und Free +)Pro und höher Kostenpflichtige Angebote: in der Konsole sichtbar, ohne Lizenz gesperrt. Ab Pro, sofern nicht Agency oder Enterprise angegeben ist
- Routenprofil: deklarierte Methoden, Pfade, Inhaltstypen, Anfrage- und Batch-Größen, zuerst im LernmodusKostenlos
- API schützen: geführte Einrichtung aus einer Adresse oder einer Spezifikation, mit Bericht darüber, was abgelehnt würdeKostenlos
- Register zur Abdeckung der OWASP API Top 10, mit sicheren Ein-Klick-KorrekturenKostenlos
- Injections in JSON-Werten und Mass Assignment, GraphQL-Limits (Tiefe, Alias, Batch, Komplexität)Kostenlos
- JWT-Prüfungen (Signatur, Algorithmus, Claims, JWKS) und Schlüsselerkennung bei Ihrem OIDC-AusstellerKostenlos
- API-Schlüssel mit Geltungsbereichen je Methode und Pfad, Kontingenten und RotationKostenlos
- BOLA/IDOR: eine Identität, die zu viele Objekte anfasstKostenlos
- WebSocket-Limits pro VerbindungKostenlos
- Endpunkt-Erkennung aus dem Verkehr, erzeugtes OpenAPI, Shadow- und Zombie-APIs, HaltungsbewertungKostenlos
- Spezifikationsimport und Validierung von Anfragen und Antworten: OpenAPI 3, Swagger 2, GraphQL-SDL, gRPC-ProtoPro und höher
- BOLA: Kennungen, die diesem Client nie zugewiesen wurden, aus dem Verkehr gelerntPro und höher
- Schutz testen mit harmlosen Angriffen, Simulation auf vergangenem Verkehr, ProfilimportPro und höher
- Verbraucher, Pläne und Kontingente, private Nutzungsseiten, Limits pro Schlüssel oder BenutzerPro und höher
- Signierte eingehende Webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio und generisches HMACPro und höher
Zum Standardwert einer erweiterten Option zurückzukehren ist immer möglich. Was am Ende einer kostenpflichtigen Lizenz geschieht, steht in den FAQ zu den Preisen: 48 Stunden Karenzzeit, 48 Stunden Nur-Lesen, danach WAF-Schutz aus bis zur Verlängerung.
Stellen Sie noch heute einen Schild vor Ihre Anwendungen
Installieren Sie es auf Ihrem eigenen Server oder schreiben Sie uns, um über Lizenzen zu sprechen.