What is an API?
An application programming interface (API) is a set of rules that lets one program use another program's features or data. Apps use APIs for tasks such as getting a location or sending payments, so the credentials that unlock them are attacker targets.
Also known as: API, APIs
Researched and fact-checked by AI, with no human review. 5 sources listed below. How we verify
Last updated
How does an API work?
An API lets one piece of software interact with another, rather than with a person. Mozilla's developer documentation describes it as a simple contract between the application offering it and the software that uses it. The US National Institute of Standards and Technology defines it as an access point or library function with a well-defined syntax.
On the web, developers use APIs to work with a browser, the user's device or outside services. Mozilla gives examples:
- capturing audio and video from a webcam
- getting a device's location
- animating parts of a web page
Why are APIs a security target?
APIs tend to expose more entry points than ordinary web applications, the OWASP API Security Project says. Its 2023 list of top API security risks includes broken authentication and improper inventory management. It says a current inventory of deployed API versions helps reduce problems such as outdated versions and exposed debug endpoints.
Real attacks show what is at stake. In October 2026, India's CERT-In described campaigns against lenders, fintech firms and payment providers. Attackers stole credentials for payment and bank APIs, it said. They then called fund-transfer APIs directly, bypassing checks in the firms' own applications.
How can organizations protect them?
CERT-In told firms to keep a complete inventory of their APIs and retire unused ones. It also urged them to store API keys in secure secret managers and drop long-lived static tokens.
Its October 15 advisory looked at recent incidents driven by AI agents. It listed dormant, outdated and test APIs left reachable from the internet among the weaknesses exploited. The AI-enabled cyber threat tracker follows such cases.
Sources
- API - Glossary | MDN, Mozilla (MDN Web Docs)
- Application Programming Interface (API) - Glossary | CSRC, National Institute of Standards and Technology (NIST) Computer Security Resource Center
- OWASP Top 10 API Security Risks – 2023, OWASP API Security Project
- Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities, Indian Computer Emergency Response Team (CERT-In)
- AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets, Indian Computer Emergency Response Team (CERT-In)
