API Shield

1

Overview

API Shield

Cloudflare API Shield protects your APIs against attacks, abuse, and data leaks. It combines schema validation, mTLS authentication, automatic endpoint discovery, and anomaly detection to ensure only valid, authorized requests reach your API.

Think of it this way

It's like a smart doorman who knows every allowed visitor, checks their documents, and only lets in those who follow the exact rules of behavior.

Features

  • OpenAPI Schema Validation
  • mTLS Authentication
  • Automatic endpoint discovery
  • Request sequence detection
1/8
API CLIENT📱Mobile / Web / IoTPOST /api/v1/ordersAuthorization: Bearer ...Content-Type: application/json{"item": "abc", "qty": 2}API SHIELDSCHEMA VALIDATIONOpenAPI 3.0 / 3.1✓ Path Valid/api/v1/orders✓ Body ValidJSON schema OK✗ Extra field "hack" blockedMTLS AUTHENTICATIONMutual TLS🔐Client CertValid ✓🏢CA TrustVerified ✓API DISCOVERYEndpoint Inventory📍 Discovered Endpoints:/api/v1/users • /api/v1/orders⚠ Shadow: /api/internal/debugSEQUENCE DETECTIONRequest Flow Analysis1. Login2. Token3. Request⚠ Skip detected → ChallengeAPI RATE LIMITING📊 /orders: 100/min📊 /login: 10/min📊 /checkout: 5/min429 Too ManyAPI ANALYTICS✓ 12.5K valid/hour✗ 234 blocked/hour📈 Logpush Ready✓ ALLOW → API🤖 CHALLENGE🚫 BLOCKAPI SERVER🖥️Protected ✓Only valid requestsHTTP 200 OKBLOCKED🚫Invalid Request403 / 429 / 400LEGENDAValid RequestmTLS AuthDiscoveryBlockedChallenge