API Security Score Calculator

Score your API estate across authorisation, authentication, rate limiting, schema validation, transport and monitoring, minus shadow APIs.

About API Security Score Calculator

Object-level authorisation carries the heaviest weight because it is the most frequently exploited API weakness and the one no gateway can enforce for you. The shadow deduction reflects that coverage percentages are measured against the APIs you know about, so an undocumented estate inflates every other number. API estates grow faster than the controls around them, and the endpoints that cause incidents are usually the ones nobody remembered were still deployed.

Formulas

API Security Score

pillar score = 0.20 object-level authorisation + 0.18 authentication + 0.14 rate limiting + 0.14 schema validation + 0.12 transport + 0.12 monitoring + 0.10 inventory, each 0–100.

object-level authorisation: The most exploited API weakness, so the heaviest weight
inventory: Share of the estate that is documented and owned

Shadow API deduction

final score = pillar score − 0.3 × shadow API share, where the shadow share is undocumented or deprecated APIs as a percentage of the estate.

shadow API: An endpoint in production that no inventory or policy covers
0.3: Points removed per percentage point of shadow estate

Worked example

With the default values below, API Security Score Calculator returns API Security Score of 67. Change any input above and every figure here is recalculated in your browser.

Inputs used

Object-level authorisation coverageaccepts 0–100 %: 65 %
Authentication strengthaccepts 0–100 %: 80 %
Rate limiting coverageaccepts 0–100 %: 70 %
Request and response schema validation coverageaccepts 0–100 %: 60 %
Transport securityaccepts 0–100 %: 90 %
Logging and anomaly monitoring coverageaccepts 0–100 %: 55 %
Documented inventory coverageaccepts 0–100 %: 75 %
APIs in the estateaccepts 1–100,000 APIs: 180 APIs
Shadow, deprecated or undocumented APIsaccepts 0–100,000 APIs: 22 APIs

Results

API Security Score: 67 / 100
API Security Grade: C — Fair
Weighted Pillar Score: 70.5 / 100
Shadow API Share: 12.2%
Shadow API Deduction: 3.7 points
Highest-Value Fix: Log and alert on anomalous access breadth per credential

Step by step

1Values used
2API Security Score
3Shadow API deduction
4API Security Score= 67 / 100
5API Security Grade= C — Fair
6Weighted Pillar Score= 70.5 / 100
7Shadow API Share= 12.2
8Shadow API Deduction= 3.7 points
9Highest-Value Fix= Log and alert on anomalous access breadth per credential

Assumptions and limits

The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is API Security Score calculated?

pillar score = 0.20 object-level authorisation + 0.18 authentication + 0.14 rate limiting + 0.14 schema validation + 0.12 transport + 0.12 monitoring + 0.10 inventory, each 0–100. Object-level authorisation carries the heaviest weight because it is the most frequently exploited API weakness and the one no gateway can enforce for you. The shadow deduction reflects that coverage percentages are measured against the APIs you know about, so an undocumented estate inflates every other number.

Why does API Security Score matter?

API estates grow faster than the controls around them, and the endpoints that cause incidents are usually the ones nobody remembered were still deployed.

What values do I need to enter?

This calculator takes 9 inputs: Object-level authorisation coverage, Authentication strength, Rate limiting coverage, Request and response schema validation coverage, Transport security, Logging and anomaly monitoring coverage, Documented inventory coverage, APIs in the estate, Shadow, deprecated or undocumented APIs. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How do I find shadow APIs?

Work from traffic rather than documentation: pull hostnames and paths from gateway and load-balancer logs, cloud provider inventories and DNS records, then subtract what your specification catalogue covers. Whatever is left is unowned by definition, and each one needs an owner, a retirement date or a policy.