Authors: Prajwal Turankar, Professor Bhosale S.B, Professor Bangar A.P, Professor A.A. Khatri
Abstract: Application Programming Interfaces (APIs) enable communication between applications, services, and distributed systems. As web, mobile, cloud-native, and microservice architectures increasingly depend on APIs, their endpoints also provide opportuni-ties for unauthorized access, data exposure, service disruption, and misuse of security mechanisms. This paper presents a re-view of four recent peer-reviewed sources on API security (a systematic review of security-API misuse detection, a systematic review of web API vulnerabilities and developer challenges, an overview of API protection across the software development life cycle, and a discussion of emerging technologies) and uses their combined findings to build a case for, and a design of, an integrated two-module security framework: a design-time control module aligned with the SDLC, and a runtime protection and monitoring module. The review covers recurring vulnerabilities (broken object-level authorization, weak authentication, exces-sive data exposure, injection, misconfiguration, inadequate rate limiting, poor asset management, and insufficient logging), the human and technical causes of insecure implementation, static, dynamic, heuristic, and machine-learning-based detection ap-proaches, and emerging directions including AI/ML, zero trust, and adaptive authentication. The paper then details a proposed framework architecture, data and tooling requirements, an evaluation plan with specific metrics, expected outcomes, and a dis-cussion of limitations and future work. The overall conclusion is that API security should be treated as a continuous lifecycle responsibility, and that emerging technologies should complement, not replace, fundamental controls.
