Protect without a specification
Give the address of the API or load an OpenAPI file, a GraphQL schema or a proto file. ToutWAF recognises the type of API and prepares the protection.
API security
Protect an API without writing a specification: ToutWAF builds a route profile, watches it without refusing anything, shows what it would have blocked, then you switch to blocking. Tokens, keys, GraphQL limits and OWASP API Top 10 coverage complete it.
Where to find it in the console : Protection menu: API security (tabs Protect my API, OWASP coverage, Inventory, Specifications, Keys).
What it is for
Learn before refusing
In learning mode, nothing is refused. A report lists what would have been blocked, with the cause and the fix, until the profile is ready.
Know where you stand
A tab lists the ten risks of the OWASP API Security Top 10 with their state and a safe-fix button when one exists.
Control who calls and how much
JWT tokens, API keys with scopes and quotas, GraphQL limits, WebSocket limits, detection of identifier enumeration.
Protect my API in three steps
Nothing has to be typed on a server. Every step is reversible.
Your API
ToutWAF contacts only the address you give, without credentials, refuses internal addresses and recognises REST, GraphQL, SOAP, gRPC, OData, JSON-RPC, tRPC and WebSocket.
A profile in learning mode
Declared methods and paths, accepted content types, maximum request and batch size. The report « What would have been blocked » fills in as traffic arrives.
Switching to blocking
The state says when it is ready. Switching asks for confirmation and states how many requests would have been refused; « Back to learning » undoes it.
The protection building blocks
Gratuito
They combine; the assistant switches on those that suit your API.
- Route profile: only the declared methods and paths get through, with their content types and sizes.
- JWT: signature, allowed algorithm (an unsigned token is refused), issuer, audience, expiry, JWKS keys with rotation, and key discovery from your OIDC issuer.
- API keys: scopes per method and path, per-minute quotas, rotation with a grace period; the secret is shown only at creation.
- Injections in JSON values and mass assignment are detected by the built-in detectors.
GraphQL and WebSocket
Gratuito
Limits that prevent oversized requests.
- GraphQL: depth, aliases, batch size and complexity are limited (10, 15, 10 and 1000 by default), and introspection is blocked by default.
- WebSocket: message size, rate per connection, volume per minute and valid JSON on the paths you list; a violation closes the connection.
Identifier enumeration (BOLA and IDOR)
GratuitoPro e superiori
A heuristic, not an authorization check: only your API's code knows who owns what.
- Free: an identity (key, token subject, session) that asks for too many distinct objects within a time window is flagged.
- Licence required: an identifier this client was never given, learned from JSON responses, is flagged; in detection only by default.
OWASP API Top 10 coverage
Gratuito
Each risk is marked Protected, Partly protected or Not protected, with the checks in plain words and the findings of the last 30 days.
- The « Fix it » button switches on only controls that cannot break a normal API, and keeps a value you chose. A risk that needs a choice links to the right tab.
- The limits are written on the page: object-level authorization stays in your code, stock hoarding and content scraping are not detected, and unsafe consumption of third-party APIs never goes beyond « partial ».
- The profile exports as YAML with no secret or address, to keep next to the API's code.
API discovery
Gratuito
On by default: the engine inventories what it sees go by.
- Observed endpoints, parameters and sensitive-data classes, merged with your imported specifications.
- An OpenAPI document can be generated from the traffic; shadow (undocumented) and zombie (unused) APIs are listed; a posture score relies on the OWASP checklist.
- A new site has no traffic yet: nothing is discovered before the first requests.
Licence required
Pro e superiori
Visible in the console but locked without a licence. What is already configured keeps being enforced after expiry.
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL schema, gRPC proto file.
- « Test my protection » with harmless attacks, simulation on past traffic and profile import.
- Consumers, plans, quotas and private usage pages; limits per key or per user.
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC.
What is not done, or not proven
We prefer to say it plainly.
- Not done: AsyncAPI parsing (a document is kept but not enforced), OAuth2 token introspection and mutual TLS for partner APIs. PayPal webhooks are not supported.
- Only one specification per site is enforced. gRPC is not deeply inspected; only validation with a proto file (under licence) does it.
- JWT, API keys, the route profile and BOLA are off by default: the assistant or your settings switch them on site by site. For a WebSocket, only the messages sent by the browser are inspected.
- The assistant's checks (detection of each stack's specification address, the probes of « Test my protection », the learning report) were exercised against simulated local servers, not against a real application of each stack.
Use cases
A mobile API with no documentation
The assistant learns the routes from real traffic, the report shows the gaps, you switch to blocking when it is empty.
A public GraphQL API
Depth, aliases and complexity bounded, introspection closed, and a clear refusal for oversized queries.
An API open to partners
Keys with scopes and quotas, tokens verified against your issuer, and per-consumer plans under licence.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
- Profilo di route: metodi, percorsi, tipi di contenuto e dimensioni di richiesta e di batch dichiarati, prima in apprendimentoGratuito
- Proteggere la mia API: configurazione guidata da un indirizzo o da una specifica, con un rapporto su ciò che verrebbe rifiutatoGratuito
- Scheda di copertura dell'OWASP API Top 10, con correzioni sicure con un clicGratuito
- Injection nei valori JSON e mass assignment, limiti GraphQL (profondità, alias, batch, complessità)Gratuito
- Controlli JWT (firma, algoritmo, claim, JWKS) e scoperta delle chiavi presso il tuo emittente OIDCGratuito
- Chiavi API con ambiti per metodo e percorso, quote e rotazioneGratuito
- BOLA/IDOR: una stessa identità che tocca troppi oggettiGratuito
- Limiti WebSocket per connessioneGratuito
- Scoperta degli endpoint dal traffico, OpenAPI generato, API ombra e zombie, punteggio di posturaGratuito
- Importazione della specifica e validazione di richieste e risposte: OpenAPI 3, Swagger 2, schema GraphQL, proto gRPCPro e superiori
- BOLA: identificatori mai assegnati a questo client, appresi dal trafficoPro e superiori
- Testare la mia protezione con attacchi innocui, simulazione sul traffico passato, importazione di un profiloPro e superiori
- Consumatori, piani e quote, pagine di utilizzo private, limiti per chiave o per utentePro e superiori
- Webhook in ingresso firmati: Stripe, GitHub, GitLab, Slack, Shopify, Twilio e HMAC genericoPro e superiori
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.