Score your API estate across authorisation, authentication, rate limiting, schema validation, transport and monitoring, minus shadow APIs.
Object-level authorisation carries the heaviest weight because it is the most frequently exploited API weakness and the one no gateway can enforce for you. The shadow deduction reflects that coverage percentages are measured against the APIs you know about, so an undocumented estate inflates every other number. API estates grow faster than the controls around them, and the endpoints that cause incidents are usually the ones nobody remembered were still deployed.
API Security Score
pillar score = 0.20 object-level authorisation + 0.18 authentication + 0.14 rate limiting + 0.14 schema validation + 0.12 transport + 0.12 monitoring + 0.10 inventory, each 0–100.
Shadow API deduction
final score = pillar score − 0.3 × shadow API share, where the shadow share is undocumented or deprecated APIs as a percentage of the estate.
pillar score = 0.20 object-level authorisation + 0.18 authentication + 0.14 rate limiting + 0.14 schema validation + 0.12 transport + 0.12 monitoring + 0.10 inventory, each 0–100. Object-level authorisation carries the heaviest weight because it is the most frequently exploited API weakness and the one no gateway can enforce for you. The shadow deduction reflects that coverage percentages are measured against the APIs you know about, so an undocumented estate inflates every other number.
API estates grow faster than the controls around them, and the endpoints that cause incidents are usually the ones nobody remembered were still deployed.
This calculator takes 9 inputs: Object-level authorisation coverage, Authentication strength, Rate limiting coverage, Request and response schema validation coverage, Transport security, Logging and anomaly monitoring coverage, Documented inventory coverage, APIs in the estate, Shadow, deprecated or undocumented APIs. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Work from traffic rather than documentation: pull hostnames and paths from gateway and load-balancer logs, cloud provider inventories and DNS records, then subtract what your specification catalogue covers. Whatever is left is unowned by definition, and each one needs an owner, a retirement date or a policy.