Designing API security
As part of the API design process, you need to specify which consumers can access your API (authentication) and what they are allowed to do (authorization).
You may want to simply define a common security for your entire API, or choose a finer policy with a specific security for a critical resource.
You may also want to specify that certain operations are freely accessible without authentication.
API Designer
can handle all these cases with the main security types:
- Basic authentication
- Bearer authentication
- Digest authentication
- OAuth 1.0
- OAuth 2.0
- OpenID Connect
- Custom / API key
- Pass through
Cookie authentication is not supported.
Creating a security scheme
Create a security scheme to be used globally in your API version or in individual elements.
- Enter other parameters specific to the selected type.
Your security scheme is now created, you can use it in your API's global settings
or in specific resources and operations.
Defining your API security
Define security schemes for your API, resources, and operations.
- In the Global securitysection, add your security schemes
and select the ones that you want to apply globally to your API version.
- Select a resource and choose the security schemes your want to apply to all of
your resource's operations.
Alternatively, you can select an operation to define its specific security.
