API perimeter & origin protection

Why it matters

An API may have several front doors: a custom hostname, CDN, gateway endpoint, private network path, or regional origin. A policy at one door protects only requests that pass through it. Draw every reachable path before choosing controls.

A WAF can filter traffic at an edge or supported API type, but a public origin may still be reachable directly. Private endpoints and public mutual TLS solve different access problems; in some platforms they cannot be combined on one API.

Decisions to make

• Decide whether callers need public access, a private network path, client certificates, or a combination across separate endpoints.
• List default gateway hosts, custom domains, CDN paths, WebSockets, health routes, and administrative routes.
• Choose where WAF, IP, geo, bot, rate, and application authorization rules are enforced.
• Define how direct-origin requests are refused when edge inspection is required.
• Plan certificate and truststore issuance, rotation, revocation, and customer ownership.
• Check whether the chosen API type supports the intended private, mTLS, and WAF controls.

Build checklist

• Draw a request-path inventory from every client to every reachable origin.
• Apply an explicit origin gate and test direct requests that bypass the preferred edge.
• Keep user and tenant authorization at the application even when the network gate passes.
• Test allowed and denied requests for each hostname, network, certificate, and API stage.
• Rotate certificates and network rules in a way that preserves a tested recovery path.
• Review logs for blocked traffic without storing secrets or sensitive request bodies unnecessarily.

Common mistakes

• Putting a WAF on CloudFront while leaving the same API public at its origin hostname.
• Treating an IP address or a client certificate as complete tenant authorization.
• Assuming private APIs and native mutual TLS are interchangeable or always composable.

Tools & references

4 starting points to compare or study. Check fit, maintenance, terms and current capabilities before choosing one.