Protect without a specification
Give the address of the API or load an OpenAPI file, a GraphQL schema or a proto file. ToutWAF recognises the type of API and prepares the protection.
API security
Protect an API without writing a specification: ToutWAF builds a route profile, watches it without refusing anything, shows what it would have blocked, then you switch to blocking. Tokens, keys, GraphQL limits and OWASP API Top 10 coverage complete it.
Where to find it in the console : Protection menu: API security (tabs Protect my API, OWASP coverage, Inventory, Specifications, Keys).
What it is for
Learn before refusing
In learning mode, nothing is refused. A report lists what would have been blocked, with the cause and the fix, until the profile is ready.
Know where you stand
A tab lists the ten risks of the OWASP API Security Top 10 with their state and a safe-fix button when one exists.
Control who calls and how much
JWT tokens, API keys with scopes and quotas, GraphQL limits, WebSocket limits, detection of identifier enumeration.
Protect my API in three steps
Nothing has to be typed on a server. Every step is reversible.
Your API
ToutWAF contacts only the address you give, without credentials, refuses internal addresses and recognises REST, GraphQL, SOAP, gRPC, OData, JSON-RPC, tRPC and WebSocket.
A profile in learning mode
Declared methods and paths, accepted content types, maximum request and batch size. The report « What would have been blocked » fills in as traffic arrives.
Switching to blocking
The state says when it is ready. Switching asks for confirmation and states how many requests would have been refused; « Back to learning » undoes it.
The protection building blocks
Gratuito
They combine; the assistant switches on those that suit your API.
- Route profile: only the declared methods and paths get through, with their content types and sizes.
- JWT: signature, allowed algorithm (an unsigned token is refused), issuer, audience, expiry, JWKS keys with rotation, and key discovery from your OIDC issuer.
- API keys: scopes per method and path, per-minute quotas, rotation with a grace period; the secret is shown only at creation.
- Injections in JSON values and mass assignment are detected by the built-in detectors.
GraphQL and WebSocket
Gratuito
Limits that prevent oversized requests.
- GraphQL: depth, aliases, batch size and complexity are limited (10, 15, 10 and 1000 by default), and introspection is blocked by default.
- WebSocket: message size, rate per connection, volume per minute and valid JSON on the paths you list; a violation closes the connection.
Identifier enumeration (BOLA and IDOR)
GratuitoPro y superiores
A heuristic, not an authorization check: only your API's code knows who owns what.
- Free: an identity (key, token subject, session) that asks for too many distinct objects within a time window is flagged.
- Licence required: an identifier this client was never given, learned from JSON responses, is flagged; in detection only by default.
OWASP API Top 10 coverage
Gratuito
Each risk is marked Protected, Partly protected or Not protected, with the checks in plain words and the findings of the last 30 days.
- The « Fix it » button switches on only controls that cannot break a normal API, and keeps a value you chose. A risk that needs a choice links to the right tab.
- The limits are written on the page: object-level authorization stays in your code, stock hoarding and content scraping are not detected, and unsafe consumption of third-party APIs never goes beyond « partial ».
- The profile exports as YAML with no secret or address, to keep next to the API's code.
API discovery
Gratuito
On by default: the engine inventories what it sees go by.
- Observed endpoints, parameters and sensitive-data classes, merged with your imported specifications.
- An OpenAPI document can be generated from the traffic; shadow (undocumented) and zombie (unused) APIs are listed; a posture score relies on the OWASP checklist.
- A new site has no traffic yet: nothing is discovered before the first requests.
Licence required
Pro y superiores
Visible in the console but locked without a licence. What is already configured keeps being enforced after expiry.
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL schema, gRPC proto file.
- « Test my protection » with harmless attacks, simulation on past traffic and profile import.
- Consumers, plans, quotas and private usage pages; limits per key or per user.
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC.
What is not done, or not proven
We prefer to say it plainly.
- Not done: AsyncAPI parsing (a document is kept but not enforced), OAuth2 token introspection and mutual TLS for partner APIs. PayPal webhooks are not supported.
- Only one specification per site is enforced. gRPC is not deeply inspected; only validation with a proto file (under licence) does it.
- JWT, API keys, the route profile and BOLA are off by default: the assistant or your settings switch them on site by site. For a WebSocket, only the messages sent by the browser are inspected.
- The assistant's checks (detection of each stack's specification address, the probes of « Test my protection », the learning report) were exercised against simulated local servers, not against a real application of each stack.
Use cases
A mobile API with no documentation
The assistant learns the routes from real traffic, the report shows the gaps, you switch to blocking when it is empty.
A public GraphQL API
Depth, aliases and complexity bounded, introspection closed, and a clear refusal for oversized queries.
An API open to partners
Keys with scopes and quotas, tokens verified against your issuer, and per-consumer plans under licence.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiciónGratuito Incluido en todas las ofertas, también en las dos gratuitas (Free y Free +)Pro y superiores Ofertas de pago: visible en la consola, bloqueada sin licencia. Desde Pro, salvo que se indique Agency o Enterprise
- Perfil de rutas: métodos, rutas, tipos de contenido y tamaños de petición y de lote declarados, primero en aprendizajeGratuito
- Proteger mi API: configuración guiada a partir de una dirección o una especificación, con un informe de lo que se rechazaríaGratuito
- Pestaña de cobertura del OWASP API Top 10, con correcciones seguras con un clicGratuito
- Inyecciones en valores JSON y asignación masiva, límites GraphQL (profundidad, alias, lote, complejidad)Gratuito
- Comprobaciones JWT (firma, algoritmo, claims, JWKS) y descubrimiento de claves en su emisor OIDCGratuito
- Claves de API con ámbitos por método y ruta, cuotas y rotaciónGratuito
- BOLA/IDOR: una misma identidad que toca demasiados objetosGratuito
- Límites de WebSocket por conexiónGratuito
- Descubrimiento de endpoints a partir del tráfico, OpenAPI generado, API en la sombra y zombis, puntuación de posturaGratuito
- Importación de especificaciones y validación de peticiones y respuestas: OpenAPI 3, Swagger 2, esquema GraphQL, proto gRPCPro y superiores
- BOLA: identificadores que nunca se han dado a este cliente, aprendidos del tráficoPro y superiores
- Probar mi protección con ataques inofensivos, simulación sobre el tráfico pasado, importación de un perfilPro y superiores
- Consumidores, planes y cuotas, páginas de uso privadas, límites por clave o por usuarioPro y superiores
- Webhooks entrantes firmados: Stripe, GitHub, GitLab, Slack, Shopify, Twilio y HMAC genéricoPro y superiores
Volver al valor por defecto de una opción avanzada siempre es posible. Lo que ocurre al final de una licencia de pago se describe en las preguntas frecuentes de precios: 48 horas de gracia, 48 horas de solo lectura y después la protección WAF se desactiva hasta la renovación.
Precios Read the documentation
Ponga un escudo delante de sus aplicaciones hoy mismo
Instálelo en su propio servidor, o escríbanos para hablar de licencias.