Protect without a specification
Give the address of the API or load an OpenAPI file, a GraphQL schema or a proto file. ToutWAF recognises the type of API and prepares the protection.
API security
Protect an API without writing a specification: ToutWAF builds a route profile, watches it without refusing anything, shows what it would have blocked, then you switch to blocking. Tokens, keys, GraphQL limits and OWASP API Top 10 coverage complete it.
Where to find it in the console : Protection menu: API security (tabs Protect my API, OWASP coverage, Inventory, Specifications, Keys).
What it is for
Learn before refusing
In learning mode, nothing is refused. A report lists what would have been blocked, with the cause and the fix, until the profile is ready.
Know where you stand
A tab lists the ten risks of the OWASP API Security Top 10 with their state and a safe-fix button when one exists.
Control who calls and how much
JWT tokens, API keys with scopes and quotas, GraphQL limits, WebSocket limits, detection of identifier enumeration.
Protect my API in three steps
Nothing has to be typed on a server. Every step is reversible.
Your API
ToutWAF contacts only the address you give, without credentials, refuses internal addresses and recognises REST, GraphQL, SOAP, gRPC, OData, JSON-RPC, tRPC and WebSocket.
A profile in learning mode
Declared methods and paths, accepted content types, maximum request and batch size. The report « What would have been blocked » fills in as traffic arrives.
Switching to blocking
The state says when it is ready. Switching asks for confirmation and states how many requests would have been refused; « Back to learning » undoes it.
The protection building blocks
免费
They combine; the assistant switches on those that suit your API.
- Route profile: only the declared methods and paths get through, with their content types and sizes.
- JWT: signature, allowed algorithm (an unsigned token is refused), issuer, audience, expiry, JWKS keys with rotation, and key discovery from your OIDC issuer.
- API keys: scopes per method and path, per-minute quotas, rotation with a grace period; the secret is shown only at creation.
- Injections in JSON values and mass assignment are detected by the built-in detectors.
GraphQL and WebSocket
免费
Limits that prevent oversized requests.
- GraphQL: depth, aliases, batch size and complexity are limited (10, 15, 10 and 1000 by default), and introspection is blocked by default.
- WebSocket: message size, rate per connection, volume per minute and valid JSON on the paths you list; a violation closes the connection.
Identifier enumeration (BOLA and IDOR)
免费Pro 及以上
A heuristic, not an authorization check: only your API's code knows who owns what.
- Free: an identity (key, token subject, session) that asks for too many distinct objects within a time window is flagged.
- Licence required: an identifier this client was never given, learned from JSON responses, is flagged; in detection only by default.
OWASP API Top 10 coverage
免费
Each risk is marked Protected, Partly protected or Not protected, with the checks in plain words and the findings of the last 30 days.
- The « Fix it » button switches on only controls that cannot break a normal API, and keeps a value you chose. A risk that needs a choice links to the right tab.
- The limits are written on the page: object-level authorization stays in your code, stock hoarding and content scraping are not detected, and unsafe consumption of third-party APIs never goes beyond « partial ».
- The profile exports as YAML with no secret or address, to keep next to the API's code.
API discovery
免费
On by default: the engine inventories what it sees go by.
- Observed endpoints, parameters and sensitive-data classes, merged with your imported specifications.
- An OpenAPI document can be generated from the traffic; shadow (undocumented) and zombie (unused) APIs are listed; a posture score relies on the OWASP checklist.
- A new site has no traffic yet: nothing is discovered before the first requests.
Licence required
Pro 及以上
Visible in the console but locked without a licence. What is already configured keeps being enforced after expiry.
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL schema, gRPC proto file.
- « Test my protection » with harmless attacks, simulation on past traffic and profile import.
- Consumers, plans, quotas and private usage pages; limits per key or per user.
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC.
What is not done, or not proven
We prefer to say it plainly.
- Not done: AsyncAPI parsing (a document is kept but not enforced), OAuth2 token introspection and mutual TLS for partner APIs. PayPal webhooks are not supported.
- Only one specification per site is enforced. gRPC is not deeply inspected; only validation with a proto file (under licence) does it.
- JWT, API keys, the route profile and BOLA are off by default: the assistant or your settings switch them on site by site. For a WebSocket, only the messages sent by the browser are inspected.
- The assistant's checks (detection of each stack's specification address, the probes of « Test my protection », the learning report) were exercised against simulated local servers, not against a real application of each stack.
Use cases
A mobile API with no documentation
The assistant learns the routes from real traffic, the report shows the gaps, you switch to blocking when it is empty.
A public GraphQL API
Depth, aliases and complexity bounded, introspection closed, and a clear refusal for oversized queries.
An API open to partners
Keys with scopes and quotas, tokens verified against your issuer, and per-consumer plans under licence.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
- 路由配置：声明允许的方法、路径、内容类型、请求与批量大小，先在学习模式下运行免费
- 保护我的 API：根据地址或规范进行引导式设置，并报告哪些请求将被拒绝免费
- OWASP API Top 10 覆盖情况页，附安全的一键修复免费
- JSON 值中的注入和批量赋值，GraphQL 限制（深度、别名、批量、复杂度）免费
- JWT 校验（签名、算法、声明、JWKS），并可从您的 OIDC 颁发方自动获取密钥免费
- API 密钥：可按方法和路径限定范围，支持配额与轮换免费
- BOLA/IDOR：同一身份访问过多对象免费
- 按连接设置 WebSocket 限制免费
- 从流量中发现接口、生成 OpenAPI、识别影子与僵尸 API，并给出安全态势评分免费
- 导入规范并校验请求与响应：OpenAPI 3、Swagger 2、GraphQL SDL、gRPC protoPro 及以上
- BOLA：从流量中学习哪些标识符从未分配给该客户端Pro 及以上
- 用无害攻击测试我的防护，对历史流量进行模拟，导入配置Pro 及以上
- 调用方、套餐与配额、私有用量页面，按密钥或用户限流Pro 及以上
- 已签名的入站 Webhook：Stripe、GitHub、GitLab、Slack、Shopify、Twilio 及通用 HMACPro 及以上
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。