Using API Enforcement

Fastly's API Enforcement product validates incoming API requests against schemas you define and logs or blocks requests that don't conform. It runs at Fastly's Edge on HTTP and HTTPS traffic proxied through your Fastly services.

Before you begin

API Enforcement is disabled by default. To purchase the product, contact sales@fastly.com. API Enforcement requires an existing Fastly Edge service with API traffic. Traffic will only be validated for domains that are actively proxied through Fastly's Edge network, so be sure that the domains hosting your APIs are associated with a Fastly service.

Once API Enforcement is enabled and your service properly configured, account users with the appropriate permissions will be able to access the API Enforcement details in the Fastly control panel and upload OpenAPI schema files to begin validating traffic. After uploading, API Enforcement parses the file for its API operations and adds them to your API Inventory. Validation begins automatically after you set the protection mode on operations to logging or blocking, and you can monitor valid and invalid request counts at the service and operation level from the API Security > Logging page.

Limitations and considerations

Keep in mind the following limitations and considerations when using API Enforcement:

• Compute services. This product is not available for use with Compute services.
• File format. API Enforcement supports OAS v3.0.x files in JSON or YAML format.
• Schema requirements. API Enforcement can only validate traffic according to the schemas and fallback rules that you specify. False positives are possible if your schema or fallback rules do not accurately reflect your actual API.
• Number of schemas and file size. API Enforcement allows you to have 20 schemas per service. The file size may not exceed 20 MB.
• API request limitations. API Enforcement only validates HTTP and HTTPS requests. Validated request attributes include HTTP method, domain, URL path, and query parameters.

Enabling API Enforcement

To enable API Enforcement on a service, follow these steps:

1. Log in to the Fastly control panel.
2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
3. Go to Service configuration > Security.
4. Click the API Enforcement switch to On.

Uploading a new schema or updating an existing one

To upload a new schema or update an existing one, follow these steps:

1. Navigate to Security > API Security > Schemas in the Fastly control panel.
2. Click Upload schema.
3. Drag and drop the schema file onto the Fastly control panel window, or click the Upload API schema file link to select your schema file.
4. (Optional) API Enforcement will preselect a protection mode of Logging, Blocking, or None according to your Default protection mode, which is configured in Security > API Security > Settings. To change the protection mode, select one of the following options:
   • Select Logging to begin logging invalid requests without blocking them. Use this mode to observe how API Enforcement detects nonconforming requests before enabling blocking.
   • Select Blocking to block nonconforming requests at the edge before they reach your origin.
   • Select None to allow nonconforming requests without blocking or logging.
5. Click Confirm.

Changing protection modes

To change the protection mode for operations, follow these steps:

1. Navigate to Security > API Security > Schemas in the Fastly control panel.
2. Select the schema with the operations you want to edit.
3. Find an operation you want to change. From the Protection mode menu, select one of the following options:
   • Select Logging to begin logging invalid requests without blocking them. Use this mode to observe how API Enforcement detects nonconforming requests before enabling blocking.
   • Select Blocking to block nonconforming requests at the edge before they reach your origin.
   • Select None to allow nonconforming requests without blocking or logging.

Monitoring logs

You can view request and response details related to your operations from the API Security > Logging page. This page displays each request and response, how API Enforcement classified it, and which schema file it's currently associated with.

Details of invalid requests are also captured in your standard log output.

Downloading a schema

To download a schema, follow these steps:

1. Navigate to Security > API Security > Schemas in the Fastly control panel.
2. Click the more menu next to the schema you want to delete, and then select Download schema.

Deleting a schema

To delete a schema and its associated operations from API Enforcement and API Inventory, follow these steps:

1. Navigate to Security > API Security > Schemas in the Fastly control panel.
2. Click the more menu next to the schema you want to delete, and then select Delete schema.

Disabling API Enforcement

To disable API Enforcement on a service, follow these steps:

1. Log in to the Fastly control panel.
2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
3. Go to Service configuration > Security.
4. Click the API Enforcement switch to Off to immediately disable API Enforcement for this service.

Related content

• About API Enforcement