Security
An index and topic collection covering API security, identity, access management, secrets management, encryption, and threat protection. API security spans the full lifecycle of an API, from designing strong authentication and authorization, to managing keys, secrets, and certificates, to protecting runtime traffic with WAFs, rate limiting, and bot mitigation, to scanning code and dependencies for vulnerabilities. This collection brings together identity providers like Okta, Auth0, and Keycloak; secrets and key management platforms like HashiCorp Vault and AWS KMS; cloud security and WAF vendors like Cloudflare, Akamai, and Palo Alto Networks; and software supply chain security tools like Snyk, Sigstore, and Sonatype.
Index entry only — little beyond a description and a link, and nothing machine-readable enough for an agent to act on without a human reading the site first.
API Evangelist profiles Security the way a machine reads it — 31 machine-readable artifacts, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Security scores 9.5/100 (minimal), with a separate agent-readiness read of 0/100 (human only). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance. Every facet and dimension name is a link: it opens that measurement's page on APIs.io, where the rating runs across the whole catalog — the exact checks that feed it, how every profiled provider distributes on it, and who is at the top of it.
Kin Score
How this is scored →scored 2026-10-03 · rubric v0.23.0
Put this on your own site. The badge is drawn live from Security's current Kin Score — paste it once and it updates itself every time the score is recomputed. It follows your visitor's light or dark setting, and it links back here so anyone who sees it can read the full breakdown.
<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/security/"
title="Security on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/security.svg"
alt="Security Kin Score — API readiness rating by API Evangelist" width="150" height="150" loading="lazy">
</a>[](https://providers.apievangelist.com/providers/security/)<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/security/"
title="Security on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/security/card.svg"
alt="Security Kin Score — API readiness rating by API Evangelist" width="340" height="120" loading="lazy">
</a>More shapes, themes and sizes → · Score as JSON · How badges work
How we profile Security
Each block below is one kind of artifact we hold for Security. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
Features 8
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Authentication and Identity
Identity platforms like Okta, Auth0, Keycloak, and Microsoft Entra provide OAuth 2.0, OIDC, SAML, and social login flows so APIs do not have to roll their own authentication.
Authorization and Fine-Grained Access
Tools like OpenFGA, Ory, Amazon Verified Permissions, and SailPoint implement role-based, attribute-based, and relationship-based access control at the API and resource level.
Secrets and Key Management
Platforms like HashiCorp Vault, AWS KMS, Azure Key Vault, and 1Password centralize the storage, rotation, and auditing of API keys, tokens, database credentials, and encryption ...
API Threat Protection and WAF
Edge security platforms like Cloudflare, Akamai, Amazon WAF, and Fortinet inspect API traffic for OWASP API Top 10 attacks, bot abuse, credential stuffing, and DDoS at the netwo...
API Security Posture and Scanning
Specialized API security tools like 42Crunch, Traceable, and Salt scan OpenAPI specifications and live traffic for misconfigurations, broken authentication, and excessive data e...
Software Supply Chain Security
Tools like Snyk, Sonatype, JFrog Xray, Sigstore, and Trivy scan code, dependencies, containers, and artifacts for vulnerabilities and verify provenance before APIs reach product...
Runtime and Workload Security
Runtime security platforms like Falco, Sysdig, Aqua Security, and StackRox monitor containers and Kubernetes workloads that host APIs for suspicious behavior and policy violations.
Certificate and TLS Management
Certificate authorities and managers like Let's Encrypt, DigiCert, and AWS Private CA issue, rotate, and revoke TLS certificates that secure API endpoints in transit.
Scroll within the panel for all 8 ·
Semantic Vocabularies 1
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Security Context
JSON-LDJSON Schema 2
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
OAuthClient
JSON SCHEMASecret
JSON SCHEMAJSON Structure 2
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Security Oauth Client Structure
JSON STRUCTURESecurity Secret Structure
JSON STRUCTUREExamples 2
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Security Secret Example
EXAMPLEUse Cases 8
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
OAuth 2.0 and OIDC for API Access
Use an identity provider like Okta, Auth0, or Keycloak to issue access tokens and ID tokens that API gateways and services validate on every request.
Centralized Secrets for Microservices
Replace hard-coded credentials with short-lived secrets fetched from HashiCorp Vault or AWS Secrets Manager so each service authenticates with its own dynamically issued identity.
WAF and Bot Mitigation in Front of APIs
Place a WAF like Cloudflare or Akamai in front of public APIs to block OWASP API Top 10 attacks, credential stuffing, scraping bots, and volumetric DDoS before they reach origin.
API Security Testing in CI/CD
Integrate API security scanners like 42Crunch and dependency scanners like Snyk into CI/CD pipelines so vulnerabilities are caught before APIs ship.
Privileged Access Management
Use CyberArk, BeyondTrust, or 1Password to broker, monitor, and rotate access to administrative APIs and infrastructure credentials.
Zero Trust and Workload Identity
Issue cryptographic workload identities with SPIFFE/SPIRE so services authenticate to APIs using verifiable identities instead of static API keys.
Vulnerability and Posture Management
Continuously scan APIs, hosts, containers, and cloud accounts with Qualys, Rapid7, CrowdStrike, or Sysdig to detect exposed endpoints and misconfigurations.
Signed Artifacts and Supply Chain Attestation
Use Sigstore, Sonatype, and JFrog Xray to sign, verify, and attest the provenance of API server images and their dependencies.
Scroll within the panel for all 8 ·
Integrations 8
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
Okta
Identity platform providing OAuth 2.0, OIDC, SAML, MFA, and lifecycle management for workforce and customer identities accessing APIs.
Auth0
Developer-friendly identity platform (now part of Okta) for adding authentication, social login, and authorization to APIs.
HashiCorp Vault
Secrets management platform for storing, rotating, and dynamically issuing API tokens, database credentials, certificates, and encryption keys.
Cloudflare
Global edge platform providing WAF, API Shield, bot management, rate limiting, mTLS, and DDoS protection for APIs.
Snyk
Developer-first security platform that scans code, dependencies, containers, and IaC for vulnerabilities affecting API services.
Keycloak
Open-source identity and access management server implementing OAuth 2.0, OIDC, and SAML for protecting APIs and applications.
Sigstore
Open-source project for signing, verifying, and proving the provenance of software artifacts used in API supply chains.
42Crunch
API security platform that audits OpenAPI definitions, scans live APIs, and enforces security policies at the gateway.
Scroll within the panel for all 8 ·
Resources
Every other property we hold for Security — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 1
Portal, sign-up, and the first successful call
Build 1
SDKs, sample code, and the tooling you integrate with
← All providers · Data indexed from github.com/api-evangelist/security · machine-readable index on apis.io
This is an independent, third-party profile of Security, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.