---
title: "API Protection "
url: "https://docs.indusface.com/en/article/api-protection-apptrana"
language: "en"
last_updated: "2025-11-28T10:30:30.311Z"
---

# API Protection 

AppTrana ensures secure and compliant API usage by managing security statuses, endpoint configurations, and authentication mechanisms. 

-   Go to **API Security** and select the **API Protection** option 
-   Use the **All Domains** filter to choose the site where your APIs are hosted 

![](https://cdn-assets.productfruits.com/efbed8e2-9a7a-4c43-80d0-7502810c1ff6) 

-   The API Protection dashboard provides a clear overview of all API endpoints, methods, and their statuses. The sections include: 

### Search 

The search bar allows you to quickly find a specific endpoint, label, or type by entering keywords. 

### Filter 

Three filter types help refine the list: 

-   **Method:** GET, POST, PUT, DELETE, etc. 
-   **Type:** Sensitive APIs, Authenticated APIs 
-   **Status:** Pending Review, Pending Discovery, Approved, etc 

![](https://cdn-assets.productfruits.com/40885bc8-3ba9-49d8-8f13-65f82c9b5088)

## API Overview 

![](https://cdn-assets.productfruits.com/c8e3b1b7-2b84-456c-9ee5-02d0d553de2c) 

| **Column** | **Description** |
| --- | --- |
| **Endpoint** | The unique identifier for the API endpoint. This is the URL path used for each API operation. |
| **Methods** | The HTTP methods allowed for the endpoint (e.g., GET, POST, PUT, DELETE). Indicates what kind of operations are allowed for this endpoint. |
| **Authenticated** | Indicates whether authentication is required for the endpoint.  <br>**Locked**: Authentication is required.  <br>**Unlocked**: No authentication is required. |
| **Security Status** | The status of the endpoint’s security. This indicates whether the security for the endpoint has been validated and approved.  <br>**Approved**: Endpoint is secure.  <br>**Blocked**: Endpoint is blocked due to security concerns. |
| **API Status** | Shows whether the method for the endpoint is allowed or blocked.  <br>**Allowed**: The method is permitted.  <br>**Blocked**: The method is restricted. |
| **New Methods** | Indicates whether new methods or features have been added for the endpoint. Typically reflects any newly discovered or configured API methods. |
| **Path Parameters** | Displays whether path parameters (variables in the URL) are allowed for the endpoint.  <br>**Allowed**: Path parameters can be used.  <br>**Blocked**: Path parameters are not allowed. |
| **Query Parameters** | Indicates whether query parameters (parameters in the URL query string) are allowed.  <br>**Allowed**: Query parameters are permitted.  <br>**Blocked**: Query parameters are not allowed. |
| **Body Parameters** | Displays whether body parameters (data sent in the body of a POST request) are allowed for the endpoint.  <br>**Allowed**: Body parameters can be used.  <br>**Blocked**: Body parameters are restricted. |
| **Actions** | Provides actions that can be performed on the endpoint. Common actions include configuring security settings or enabling/disabling the endpoint. |
| **Tag** | A label that provides additional metadata or categorization for the endpoint (e.g., PII\_NAME). Tags often help classify the data or protection rules applied. |
| **Discovered On** | The timestamp showing when the endpoint was first discovered or added to the system. This helps track when the API was identified for protection. |

### Enable/Disable APIs 

-   These controls allow users to enable or disable the positive security model to the API.  
-   Click the specific API enpoints to enable/disable the security model.  

![](https://cdn-assets.productfruits.com/b8033296-a473-4265-8e69-c20251e41ac3) 

-   Click **Enable** to enable the policy 

![](https://cdn-assets.productfruits.com/170fa744-724b-4a4c-a865-b9a0dcea1d4e) 

-   A confirmation pop-up appears. Click **Confirm.** 

![](https://cdn-assets.productfruits.com/ec9c6b58-f81b-4508-87c1-e105b42b53eb) 

### Configure  

-   In the API list, go to the **Action** column for the endpoint you want to configure. 
-   Click **Configure**. 

![](https://cdn-assets.productfruits.com/57241cda-238a-41c7-ac8d-5d7da10215ab) 

-   The **Configure Discover Policy** window will appear. 
-   From here, user can set the required rules and behavior for the selected API. 

![A screenshot of a phone  AI-generated content may be incorrect.](https://cdn-assets.productfruits.com/bd199e8f-d839-469d-b466-e0d3a72255a5) 

-   For a detailed breakdown of all available configuration options, refer to the **Configure Discover Policy** section. 

Policies available: 

| **Policy** | **Description** |
| --- | --- |
| Block this API | Fully restricts access to the endpoint. |
| Block new methods | Only permits previously observed HTTP methods. |
| Enforce Path Parameters | Blocks requests containing unknown URL patterns. |
| Enforce Query Parameters | Allows only known query fields based on discovered traffic. |
| Enforce Body Parameters | Ensures only recognized body attributes are permitted. |

All enforcement rules apply across all detected methods for the endpoint.