Protect without a specification
Give the address of the API or load an OpenAPI file, a GraphQL schema or a proto file. ToutWAF recognises the type of API and prepares the protection.
API security
Protect an API without writing a specification: ToutWAF builds a route profile, watches it without refusing anything, shows what it would have blocked, then you switch to blocking. Tokens, keys, GraphQL limits and OWASP API Top 10 coverage complete it.
Where to find it in the console : Protection menu: API security (tabs Protect my API, OWASP coverage, Inventory, Specifications, Keys).
What it is for
Learn before refusing
In learning mode, nothing is refused. A report lists what would have been blocked, with the cause and the fix, until the profile is ready.
Know where you stand
A tab lists the ten risks of the OWASP API Security Top 10 with their state and a safe-fix button when one exists.
Control who calls and how much
JWT tokens, API keys with scopes and quotas, GraphQL limits, WebSocket limits, detection of identifier enumeration.
Protect my API in three steps
Nothing has to be typed on a server. Every step is reversible.
Your API
ToutWAF contacts only the address you give, without credentials, refuses internal addresses and recognises REST, GraphQL, SOAP, gRPC, OData, JSON-RPC, tRPC and WebSocket.
A profile in learning mode
Declared methods and paths, accepted content types, maximum request and batch size. The report « What would have been blocked » fills in as traffic arrives.
Switching to blocking
The state says when it is ready. Switching asks for confirmation and states how many requests would have been refused; « Back to learning » undoes it.
The protection building blocks
Free
They combine; the assistant switches on those that suit your API.
- Route profile: only the declared methods and paths get through, with their content types and sizes.
- JWT: signature, allowed algorithm (an unsigned token is refused), issuer, audience, expiry, JWKS keys with rotation, and key discovery from your OIDC issuer.
- API keys: scopes per method and path, per-minute quotas, rotation with a grace period; the secret is shown only at creation.
- Injections in JSON values and mass assignment are detected by the built-in detectors.
GraphQL and WebSocket
Free
Limits that prevent oversized requests.
- GraphQL: depth, aliases, batch size and complexity are limited (10, 15, 10 and 1000 by default), and introspection is blocked by default.
- WebSocket: message size, rate per connection, volume per minute and valid JSON on the paths you list; a violation closes the connection.
Identifier enumeration (BOLA and IDOR)
FreePro and above
A heuristic, not an authorization check: only your API's code knows who owns what.
- Free: an identity (key, token subject, session) that asks for too many distinct objects within a time window is flagged.
- Licence required: an identifier this client was never given, learned from JSON responses, is flagged; in detection only by default.
OWASP API Top 10 coverage
Free
Each risk is marked Protected, Partly protected or Not protected, with the checks in plain words and the findings of the last 30 days.
- The « Fix it » button switches on only controls that cannot break a normal API, and keeps a value you chose. A risk that needs a choice links to the right tab.
- The limits are written on the page: object-level authorization stays in your code, stock hoarding and content scraping are not detected, and unsafe consumption of third-party APIs never goes beyond « partial ».
- The profile exports as YAML with no secret or address, to keep next to the API's code.
API discovery
Free
On by default: the engine inventories what it sees go by.
- Observed endpoints, parameters and sensitive-data classes, merged with your imported specifications.
- An OpenAPI document can be generated from the traffic; shadow (undocumented) and zombie (unused) APIs are listed; a posture score relies on the OWASP checklist.
- A new site has no traffic yet: nothing is discovered before the first requests.
Licence required
Pro and above
Visible in the console but locked without a licence. What is already configured keeps being enforced after expiry.
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL schema, gRPC proto file.
- « Test my protection » with harmless attacks, simulation on past traffic and profile import.
- Consumers, plans, quotas and private usage pages; limits per key or per user.
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC.
What is not done, or not proven
We prefer to say it plainly.
- Not done: AsyncAPI parsing (a document is kept but not enforced), OAuth2 token introspection and mutual TLS for partner APIs. PayPal webhooks are not supported.
- Only one specification per site is enforced. gRPC is not deeply inspected; only validation with a proto file (under licence) does it.
- JWT, API keys, the route profile and BOLA are off by default: the assistant or your settings switch them on site by site. For a WebSocket, only the messages sent by the browser are inspected.
- The assistant's checks (detection of each stack's specification address, the probes of « Test my protection », the learning report) were exercised against simulated local servers, not against a real application of each stack.
Use cases
A mobile API with no documentation
The assistant learns the routes from real traffic, the report shows the gaps, you switch to blocking when it is empty.
A public GraphQL API
Depth, aliases and complexity bounded, introspection closed, and a clear refusal for oversized queries.
An API open to partners
Keys with scopes and quotas, tokens verified against your issuer, and per-consumer plans under licence.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
- Route profile: declared methods, paths, content types, request and batch sizes, in learning mode firstFree
- Protect my API: guided set-up from an address or a specification, with a report of what would be refusedFree
- OWASP API Top 10 coverage tab, with safe one-click fixesFree
- Injections in JSON values and mass assignment, GraphQL limits (depth, alias, batch, complexity)Free
- JWT checks (signature, algorithm, claims, JWKS) and key discovery from your OIDC issuerFree
- API keys with scopes per method and path, quotas and rotationFree
- BOLA/IDOR: one identity touching too many objectsFree
- WebSocket limits per connectionFree
- Endpoint discovery from traffic, generated OpenAPI, shadow and zombie APIs, posture scoreFree
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL SDL, gRPC protoPro and above
- BOLA: identifiers never given to this client, learned from trafficPro and above
- Test my protection with harmless attacks, simulation on past traffic, profile importPro and above
- Consumers, plans and quotas, private usage pages, limits per key or per userPro and above
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMACPro and above
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.