Every endpoint, four controls, zero gaps.
Tap an endpoint to see its security posture.
Endpoint 3 of 6 · 18 req/s
/api/v1/orders
Order creation. Schema validation rejects malformed payloads at the edge.
Schema ✓
OpenAPI / JSON-schema validation rejects malformed requests at the edge.
mTLS · gap
Mutual TLS — only clients with a valid issued certificate can reach this endpoint.
Rate ✓
Per-endpoint rate limiting with key by IP, JWT subject, or header.
Bot ✓
Bot score thresholds + Turnstile challenges on suspicious automation.
On this page
Nanosek provides Cloudflare API Shield services for organizations that need to discover, document, validate, secure, monitor, and operate APIs on Cloudflare. The service includes API endpoint inventory, OpenAPI schema review, schema validation planning, mTLS design, authentication review, WAF custom rules, rate limiting, Bot Management alignment, API abuse detection, Logpush visibility, dashboards, rollout planning, false-positive tuning, and managed Cloudflare operations.
Who this is for
What Cloudflare API Shield helps protect
Unknown public APIs
API discovery and traffic analysis help identify exposed endpoints, methods, versions, and hostnames that may not be fully documented.
Schema drift
Schema validation helps detect requests that do not match expected OpenAPI behavior before they reach sensitive backend services.
Unauthenticated or weakly authenticated paths
Nanosek reviews auth behavior, token expectations, mTLS options, service clients, and bypass-prone endpoints.
API abuse and scraping
Rate limiting, Bot Management, WAF custom rules, and path-specific controls reduce scripted extraction and high-volume misuse.
Credential stuffing against APIs
Login and token endpoints need API-aware rate limits, bot controls, Turnstile where appropriate, and careful false-positive handling.
Partner API misuse
Partner clients need scoped policies, allow models, service identity, mTLS or tokens, and monitoring without broad bypasses.
Expensive backend calls
High-cost endpoints can be protected with method-aware rate limits, WAF rules, cache strategy, and request validation.
Mobile API false positives
Mobile clients need traffic identification, app behavior validation, and policy exceptions that do not weaken the whole API surface.
Missing API logs
Logpush, Security Events, GraphQL Analytics, and dashboards make API decisions reviewable during tuning and incidents.
Flat web security policy
APIs should not always inherit generic website rules. Nanosek separates API controls by hostname, path, method, client type, and risk.
Versioned API risk
Older API versions may need migration, stricter controls, deprecation plans, and separate monitoring.
Unsafe enforcement
API rules should move from visibility to enforcement through validation, staged rollout, and rollback planning.
Why API Shield needs careful rollout
API protection can break legitimate clients if schema validation, mTLS, WAF rules, bot controls, or rate limits are enabled without traffic evidence. Nanosek starts with discovery and logging, maps known clients and critical endpoints, then promotes controls gradually based on impact and confidence.
Our Cloudflare API Shield approach
API discovery and inventory
- Review API hostnames, paths, methods, versions, authentication patterns, known clients, partner integrations, mobile apps, and backend dependencies.
- Use traffic, logs, documentation, OpenAPI specs, and stakeholder input to build an API inventory.
Risk and client classification
- Classify endpoints by sensitivity, cost, authentication, data exposure, abuse history, client type, and business criticality.
- Identify login, token, checkout, search, account, upload, export, admin, and partner endpoints that need specific controls.
Schema and authentication design
- Review OpenAPI specifications, schema validation readiness, mTLS requirements, certificate lifecycle, token expectations, and service authentication.
- Define which endpoints can safely enforce schema validation and which need monitoring or cleanup first.
Policy and control design
- Design API-specific WAF custom rules, rate limits, Bot Management policies, API Shield controls, mTLS, and scoped exceptions.
- Separate browser, mobile, partner, service, and public API behavior so enforcement does not rely on one generic rule.
Staged implementation
- Deploy visibility, logging, schema checks, WAF rules, and rate limits in monitoring or conservative mode where possible.
- Validate against known clients, synthetic checks, logs, and sampled requests before stronger enforcement.
Operations and tuning
- Configure Logpush, dashboards, alerts, exception review, false-positive handling, reporting, and ongoing API security tuning.
API architecture considerations
Cloudflare API controls we use
API Shield
Used for API discovery, schema validation, mTLS, endpoint visibility, and API-specific security posture.
API Discovery
Used to find undocumented or drifted endpoints from observed traffic and compare them against known API inventories.
Schema Validation
Used to validate requests against OpenAPI behavior and reduce malformed or unexpected traffic reaching origins.
mTLS
Used for partner, service-to-service, B2B, and high-trust API clients that need certificate-based identity.
WAF Custom Rules
Used to control API traffic by hostname, path, method, header, client type, country, ASN, auth signal, and risk context.
Rate Limiting
Used for login, token, search, export, upload, checkout, expensive endpoints, and repeated failed or abusive calls.
Bot Management
Used to separate legitimate clients from automation abuse, scraping, credential stuffing, and scripted API traffic.
Turnstile
Used where human verification is appropriate for suspicious signup, form, or login flows connected to APIs.
Access and service tokens
Used where internal, admin, or service API access should be identity-aware or explicitly scoped.
Origin Rules
Used to route API traffic to expected origins and validate Host header, SNI, and backend behavior.
Load Balancing and Health Checks
Used for critical API availability, failover, and backend health visibility.
Logpush
Used to export HTTP, WAF, security, bot, and API events into SIEM or data platforms.
Security Analytics
Used to review policy matches, attack patterns, false positives, and API-specific risk.
GraphQL Analytics
Used for repeatable API traffic reporting, trend analysis, and operational dashboards.
Cloudflare Workers
Used for advanced API gateway behavior, request enrichment, routing, validation, or integration logic where native controls are not enough.
| Control | When Nanosek uses it |
|---|---|
| API Shield | Used for API discovery, schema validation, mTLS, endpoint visibility, and API-specific security posture. |
| API Discovery | Used to find undocumented or drifted endpoints from observed traffic and compare them against known API inventories. |
| Schema Validation | Used to validate requests against OpenAPI behavior and reduce malformed or unexpected traffic reaching origins. |
| mTLS | Used for partner, service-to-service, B2B, and high-trust API clients that need certificate-based identity. |
| WAF Custom Rules | Used to control API traffic by hostname, path, method, header, client type, country, ASN, auth signal, and risk context. |
| Rate Limiting | Used for login, token, search, export, upload, checkout, expensive endpoints, and repeated failed or abusive calls. |
| Bot Management | Used to separate legitimate clients from automation abuse, scraping, credential stuffing, and scripted API traffic. |
| Turnstile | Used where human verification is appropriate for suspicious signup, form, or login flows connected to APIs. |
| Access and service tokens | Used where internal, admin, or service API access should be identity-aware or explicitly scoped. |
| Origin Rules | Used to route API traffic to expected origins and validate Host header, SNI, and backend behavior. |
| Load Balancing and Health Checks | Used for critical API availability, failover, and backend health visibility. |
| Logpush | Used to export HTTP, WAF, security, bot, and API events into SIEM or data platforms. |
| Security Analytics | Used to review policy matches, attack patterns, false positives, and API-specific risk. |
| GraphQL Analytics | Used for repeatable API traffic reporting, trend analysis, and operational dashboards. |
| Cloudflare Workers | Used for advanced API gateway behavior, request enrichment, routing, validation, or integration logic where native controls are not enough. |
API protection matrix
Login and token APIs
Credential stuffing, brute force, token abuse
Rate limiting, Bot Management, WAF rules, Turnstile where appropriate, careful false-positive review
Public REST APIs
Malformed requests, scraping, high-volume abuse
API Shield discovery, schema validation, WAF custom rules, rate limits, Logpush visibility
Partner APIs
Legitimate automation blocked or over-allowed
mTLS, service identity, scoped policies, per-partner rate limits, explicit exception ownership
Mobile APIs
False positives and app-specific behavior
Client classification, API-specific WAF rules, careful bot policy, staged enforcement
GraphQL endpoints
Expensive queries and abuse concentration
Rate limits, WAF rules, query controls where available, logging, cost-aware monitoring
Upload APIs
Large payload abuse, malware workflow pressure
Method-aware controls, size expectations, WAF rules, origin capacity review, monitoring
Export and reporting APIs
Data extraction and backend load
Authentication review, rate limits, bot controls, logging, and business-owner thresholds
Admin APIs
Privileged action exposure
Access, service tokens, mTLS, strict WAF rules, least-privilege client controls
Webhook receivers
Spoofed or replayed events
Signature validation, WAF rules, rate limits, Workers or Queues where appropriate
Legacy API versions
Unmaintained behavior and missing controls
Inventory, separate monitoring, stricter policy, deprecation plan, and staged migration
| API area | Common risk | Recommended Cloudflare approach |
|---|---|---|
| Login and token APIs | Credential stuffing, brute force, token abuse | Rate limiting, Bot Management, WAF rules, Turnstile where appropriate, careful false-positive review |
| Public REST APIs | Malformed requests, scraping, high-volume abuse | API Shield discovery, schema validation, WAF custom rules, rate limits, Logpush visibility |
| Partner APIs | Legitimate automation blocked or over-allowed | mTLS, service identity, scoped policies, per-partner rate limits, explicit exception ownership |
| Mobile APIs | False positives and app-specific behavior | Client classification, API-specific WAF rules, careful bot policy, staged enforcement |
| GraphQL endpoints | Expensive queries and abuse concentration | Rate limits, WAF rules, query controls where available, logging, cost-aware monitoring |
| Upload APIs | Large payload abuse, malware workflow pressure | Method-aware controls, size expectations, WAF rules, origin capacity review, monitoring |
| Export and reporting APIs | Data extraction and backend load | Authentication review, rate limits, bot controls, logging, and business-owner thresholds |
| Admin APIs | Privileged action exposure | Access, service tokens, mTLS, strict WAF rules, least-privilege client controls |
| Webhook receivers | Spoofed or replayed events | Signature validation, WAF rules, rate limits, Workers or Queues where appropriate |
| Legacy API versions | Unmaintained behavior and missing controls | Inventory, separate monitoring, stricter policy, deprecation plan, and staged migration |
API Shield rollout model
From API visibility to enforcement
Discovery
API Discovery, HTTP logs, GraphQL Analytics
Build endpoint inventory and compare observed traffic with documented APIs.
Documentation cleanup
OpenAPI schema review
Fix schema gaps before enforcing validation on critical clients.
Client classification
mTLS, headers, tokens, Access, WAF signals
Separate browser, mobile, partner, service, and unknown automation traffic.
Visibility mode
Security Events, Logpush, dashboards
Review matches and false positives before enforcement.
Controlled enforcement
Schema Validation, WAF, rate limiting, Bot Management
Promote controls per endpoint, method, and client group.
Operations
Alerts, reports, tuning backlog, managed services
Keep policy review and schema changes aligned with API releases.
| Rollout stage | Cloudflare control | Implementation notes |
|---|---|---|
| Discovery | API Discovery, HTTP logs, GraphQL Analytics | Build endpoint inventory and compare observed traffic with documented APIs. |
| Documentation cleanup | OpenAPI schema review | Fix schema gaps before enforcing validation on critical clients. |
| Client classification | mTLS, headers, tokens, Access, WAF signals | Separate browser, mobile, partner, service, and unknown automation traffic. |
| Visibility mode | Security Events, Logpush, dashboards | Review matches and false positives before enforcement. |
| Controlled enforcement | Schema Validation, WAF, rate limiting, Bot Management | Promote controls per endpoint, method, and client group. |
| Operations | Alerts, reports, tuning backlog, managed services | Keep policy review and schema changes aligned with API releases. |
Cutover checkpoints
- Known clients, mobile apps, partner integrations, and sensitive endpoints are documented.
- OpenAPI schemas are reviewed for accuracy before validation is enforced.
- Rate limits, WAF rules, and bot controls are tested against expected traffic.
- Rollback and exception paths are available for critical API clients.
Validation signals
- No unexpected increase in API 4xx or 5xx responses after policy changes.
- Security Events show expected matches without blocking known clients.
- Logs include enough fields for endpoint, method, client, action, and outcome review.
- Synthetic checks and business-critical API journeys continue to pass.
Deployment steps
- 01 Inventory API hostnames, endpoints, methods, versions, clients, authentication, and backend dependencies.
- 02 Classify sensitive endpoints, known clients, partner integrations, mobile traffic, and high-cost API paths.
- 03 Review OpenAPI schema accuracy, schema validation candidates, mTLS needs, and certificate lifecycle.
- 04 Design API-specific WAF rules, rate limits, bot controls, API Shield policies, and scoped exceptions.
- 05 Deploy initial controls in visibility or conservative mode and validate against logs, synthetic tests, and known clients.
- 06 Promote validated controls to enforcement by endpoint, method, client group, and business risk.
- 07 Operationalize dashboards, Logpush, alerts, false-positive handling, reporting, and managed tuning.
Risks and mitigations
Schema validation blocks legitimate clients
Review OpenAPI accuracy, start in visibility where possible, and enforce by endpoint after validation.
mTLS rollout disrupts partners
Plan certificate lifecycle, onboarding, revocation, test windows, and fallback paths with each partner.
Rate limits break normal workflows
Design thresholds by endpoint, method, client, user behavior, and business process.
Mobile apps are misclassified as bots
Identify app traffic, validate client behavior, and use API-specific bot policies.
WAF rules are too broad
Scope rules by API hostname, path, method, headers, and client type rather than applying generic website policy.
Unknown APIs remain exposed
Use API discovery, logs, code-owner review, and recurring inventory checks.
Partner exceptions weaken security
Use scoped allow policies, mTLS, service tokens, rate limits, owner, and expiry for exceptions.
Missing observability
Configure Security Events, Logpush, dashboards, and alerting before enforcement.
| Risk | Mitigation |
|---|---|
| Schema validation blocks legitimate clients | Review OpenAPI accuracy, start in visibility where possible, and enforce by endpoint after validation. |
| mTLS rollout disrupts partners | Plan certificate lifecycle, onboarding, revocation, test windows, and fallback paths with each partner. |
| Rate limits break normal workflows | Design thresholds by endpoint, method, client, user behavior, and business process. |
| Mobile apps are misclassified as bots | Identify app traffic, validate client behavior, and use API-specific bot policies. |
| WAF rules are too broad | Scope rules by API hostname, path, method, headers, and client type rather than applying generic website policy. |
| Unknown APIs remain exposed | Use API discovery, logs, code-owner review, and recurring inventory checks. |
| Partner exceptions weaken security | Use scoped allow policies, mTLS, service tokens, rate limits, owner, and expiry for exceptions. |
| Missing observability | Configure Security Events, Logpush, dashboards, and alerting before enforcement. |
API Shield readiness checklist
- API hostnames inventoried
- Endpoints and methods documented
- Known clients identified
- Mobile app traffic understood
- Partner integrations documented
- Authentication patterns reviewed
- OpenAPI schemas reviewed
- Schema validation candidates selected
- mTLS requirements defined
- Certificate lifecycle planned
- Sensitive endpoints classified
- Login and token paths mapped
- Rate limits designed safely
- Bot controls reviewed
- WAF custom rules drafted
- API logs and Security Events visible
- Logpush or SIEM integration reviewed
- Synthetic checks prepared
- Rollback and exception process defined
- Business owners approve enforcement
Deliverables
- API endpoint inventory
- API risk classification
- Known client and partner map
- OpenAPI schema readiness review
- API Shield implementation plan
- mTLS and certificate lifecycle design
- API-specific WAF rule set
- Rate limiting design
- Bot Management alignment
- Logpush and dashboard setup
- Validation and synthetic test matrix
- False-positive tuning report
- Rollback and exception process
- Managed operations handover
When Nanosek should help
Frequently asked questions
What is Cloudflare API Shield?
Do we need OpenAPI schemas?
Can API Shield protect mobile APIs?
When should we use mTLS?
Is rate limiting enough for API protection?
Can API Shield break legitimate traffic?
Can Nanosek help after API Shield deployment?
Protect APIs on Cloudflare with controlled enforcement
Nanosek helps you move from API visibility to enforceable protection with schema validation, mTLS, WAF, rate limiting, bot controls, observability, and managed operations.