- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Indian enterprises are racing to expose APIs — for banking aggregators, supply-chain portals, partner integrations, and mobile apps. This velocity is a strategic advantage. It is also an expanding attack surface that most organisations have not yet secured with the same rigour they apply to perimeter firewalls.
In 2024–25, API-targeted attacks became one of the fastest-growing threat vectors globally. India’s digital-first economy — with millions of UPI transactions per day, ONDC catalogue feeds, and GST e-invoice APIs — is squarely in the crosshairs. A single misconfigured API endpoint can expose customer PII at a scale that triggers obligations under both CERT-In’s six-hour incident-reporting directive and the Digital Personal Data Protection (DPDP) Act, 2023.
This guide walks through the OWASP API Security Top 10, the most common failure modes seen in Indian enterprise environments, and practical controls your security team can deploy today.
APIs are no longer back-office plumbing. They carry customer data, authorise financial transactions, and control operational technology in manufacturing and logistics. The economics of an API breach are stark:
For Indian CISOs, the regulatory angle is equally urgent. CERT-In’s April 2022 direction requires organisations to report security incidents — including data breaches — within six hours of detection. If an API exposure leads to a data breach and you lack the observability to detect it quickly, you face both the breach itself and a regulatory violation.
BOLA occurs when an authenticated user can access another user’s objects simply by changing an ID in the request path. For example: GET /api/v1/accounts/1234/statements — change 1234 to 1235 and retrieve a different customer’s statements. This is the single most common API vulnerability in Indian fintech and e-commerce environments.
Control: Enforce object-level authorisation checks at the API gateway and at the business-logic layer. Never rely on the client to provide a user’s own ID — derive it from the authenticated session token.
Weak token management, long-lived credentials, missing token expiry, and lack of brute-force protection on authentication endpoints all fall here. Mobile apps that embed API keys in APK binaries are a chronic problem in Indian retail and logistics sectors.
Control: Short-lived JWT tokens with refresh flows, rate-limiting on auth endpoints, mutual TLS for server-to-server APIs, and secret scanning in your CI/CD pipeline.
An API that returns far more fields than the calling party needs creates exfiltration risk. Attackers who discover that /api/v1/user/profile returns aadhaar_last4, pan_number, and salary_band alongside the display name have hit a jackpot.
Control: Use an allowlist of response fields per role. Implement data-minimisation at the serialisation layer, not as an afterthought in the consumer.
Without rate limits, pagination caps, or query complexity limits, a single malicious or misbehaving client can exhaust compute resources, inflate cloud costs, or cause downstream system failures. GST e-invoice gateway vendors and ONDC participants have reported exactly this class of abuse.
Control: API gateway-level rate limiting per client, per endpoint, and per tenant. Enforce maximum page sizes and request-body size limits. Implement back-pressure mechanisms for async workflows.
Admin functions exposed in the same API namespace as user functions, protected only by hidden UI rather than server-side role checks. A determined attacker who discovers DELETE /api/v1/admin/users/{id} does not need a UI to invoke it.
Control: Separate admin and user API namespaces where possible. Apply role-based access control at the API gateway before requests reach the application.
This covers automation-enabled abuse: bots that bulk-book limited inventory, scalp high-demand products, or perform credential stuffing at scale. Indian e-commerce platforms face this every time a high-demand product drops.
Control: Device fingerprinting, CAPTCHA on high-value flows, anomaly detection on business-flow rates, and bot-management solutions integrated with your API gateway.
APIs that fetch URLs on behalf of the caller can be manipulated to reach internal services — cloud metadata endpoints (AWS 169.254.169.254), internal databases, or administrative consoles. Particularly dangerous in cloud-hosted Indian SaaS platforms.
Control: Allowlist the domains your API legitimately fetches. Block RFC 1918 and link-local addresses at the network layer. Scan for SSRF patterns in your code review pipeline.
Default error messages exposing stack traces, CORS configured to allow *, HTTP instead of HTTPS for internal API traffic, debug endpoints left open in production. These misconfigurations are catalogued by CERT-In as common findings in Indian organisation security audits.
Control: Infrastructure-as-code templates with hardened defaults. Automated misconfiguration scanning in CI/CD. Regular penetration testing of API endpoints, not just network perimeter.
Shadow APIs — endpoints created during development, for partner integrations, or by legacy systems — that are no longer maintained but still reachable. Many Indian organisations discover during penetration tests that their API surface is two or three times larger than their documented inventory.
Control: Continuous API discovery through traffic analysis. API gateway as the single choke point — if it does not route an endpoint, that endpoint should not be reachable. Deprecation and sunset policies enforced at the gateway.
Trusting data from third-party APIs without validation. An API integration that injects unvalidated supplier data into an internal database can create SQL injection or XSS paths through a trusted-looking channel.
Control: Treat third-party API responses as untrusted input. Validate schemas, sanitise content, and apply the same input-validation logic you would apply to direct user input.
India’s Digital Personal Data Protection Act, 2023 establishes obligations around purpose limitation, data minimisation, and breach notification. API over-fetching (BOPLA) and misconfigured access controls (BOLA, BFLA) directly risk DPDP Act obligations because they expose personal data beyond the specified purpose.
CERT-In’s six-hour incident-reporting window is not achievable without adequate API-layer visibility. If your SOC cannot see API request logs, you cannot detect a data-exposure incident in time to meet the reporting obligation.
For DPDP Act compliance, your API security programme should support:
Fortinet’s security fabric provides several controls directly relevant to API protection. FortiGate’s next-generation firewall capabilities include application-layer inspection and SSL deep inspection for HTTPS API traffic. FortiWeb, Fortinet’s web application firewall, offers dedicated API security features including schema validation against OpenAPI/Swagger specifications, bot detection tuned for API patterns, and machine-learning-based anomaly detection on API traffic.
At PJ Networks, we configure and operate FortiGate and FortiWeb deployments for enterprise clients across banking, manufacturing, and retail sectors in India. The 24/7 NOC/SOC model means that when FortiWeb detects an anomalous spike in API requests — a potential BOLA enumeration attack — our analysts are immediately in the response loop, not reading alerts the next morning.
API security generates data across multiple layers — API gateway access logs, FortiGate session tables, FortiWeb WAF alerts, authentication service events, and cloud provider trail logs. Without a unified view, your SOC analysts are correlating incidents manually across disconnected consoles, and the six-hour CERT-In reporting window can slip past before the full picture emerges.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we deploy and operate the platform for enterprise clients who need consolidated visibility across their security and network infrastructure.
The four pillars of the platform are each directly relevant to API security operations:
SIEM — Ora’s SIEM ingests API gateway logs, FortiGate firewall events, FortiWeb WAF alerts, and authentication logs into a single correlation engine. Detection rules mapped to MITRE ATT&CK cover API-specific attack patterns: credential stuffing sequences, BOLA enumeration bursts, and SSRF probe signatures. The graph-based attack storyline reconstruction is particularly valuable for API incidents — it traces the sequence from initial reconnaissance through data extraction, so your team can answer CERT-In’s timeline questions with precision. Tiered log retention (hot/cold/archive) supports the 180-day in-country retention direction without ballooning storage costs.
NMS — API performance degradation is often an early indicator of an attack underway. Ora’s network management system provides unified observability across firewalls, API gateways, load balancers, and WAN links. ML-based anomaly detection can flag unexpected bandwidth spikes or latency changes on API-serving segments, triggering NOC investigation before the SOC sees a formal alert. For multi-vendor estates — where NOC visibility is fragmented across separate management consoles for Fortinet, Cisco, and cloud-native networking — LLDP/CDP topology discovery and unified dashboards give operators a single operational picture.
Video Surveillance (VMS) — For manufacturing, retail, and multi-site enterprise clients, physical and network security belong under one operations view. Ora’s video surveillance module supports ONVIF, Hikvision, and Dahua camera management with video analytics. When a physical-access event correlates with an anomalous API access pattern — a contractor badge-in followed immediately by a bulk data export — unified visibility makes that correlation possible. Keeping physical and network security in one SecOps platform eliminates the organisational gap that attackers exploit.
SOAR — CERT-In’s six-hour reporting window makes automated response not a luxury but a necessity. Ora’s SOAR capability includes pre-built playbooks for common API security scenarios — BOLA attack containment, credential-stuffing response, and FortiGate blocklist updates pushed automatically when a source IP is confirmed malicious. The automation is what makes the six-hour timeline realistic: by the time a human analyst reviews the incident, the initial containment actions have already fired.
If your organisation is running API workloads across multiple environments and finding that SOC visibility does not match the speed of modern API attacks, speak with our team about how we deploy and operate PrahiX Ora for enterprise clients.
API security is not a one-time project. It is an ongoing programme that evolves with your API surface. The most common advice we give enterprise IT leaders in India:
PJ Networks works with enterprise clients across India to assess, design, and operate API security programmes — from FortiWeb deployment and tuning to integrated SIEM/SOAR coverage through PrahiX Ora. If you would like to discuss your organisation’s API security posture, contact us to schedule a consultation.