Distributed application programming interface whitelisting

An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:

• receiving, by an application programming interface (API) gateway, a client API request to access an application comprising a distributed microservices architecture;
• initiating, by the API gateway, a whitelisting validation operation determine if the client API request is permitted, wherein the whitelisting validation operation comprises:
• comparing an API endpoint of the client API request to a whitelist of permitted API endpoints of registered microservices of the application to determine whether the API endpoint of the client API request comprises a permitted API endpoint in the whitelist, wherein comparing comprises identifying an element of the client API request, wherein the identified element comprises at least one of an endpoint path, an endpoint parameter, an endpoint parameter value, a specified method of the client API request, and a header of the client API request;
• utilizing the whitelist to determine whether the identified element is a permitted element of the client API request;
• and
• rejecting the client API request in response to determining that the identified element is not a permitted element of the client API request;
• and
• routing, by the API gateway, the client API request to a target microservice of the application, in response to the whitelisting validation operation determining that the client API request is permitted.

A server node, comprising:

• at least one processor;
• and
• system memory configured to store program code, wherein the program code is executable by the at least one processor to instantiate an application programming interface (API) gateway, wherein the API gateway is configured to:
• receive a client API request to access an application comprising a distributed microservices architecture;
• initiate a whitelisting validation operation determine if the client API request is permitted, wherein the whitelisting validation operation comprises:
• comparing an API endpoint of the client API request to a whitelist of permitted API endpoints of registered microservices of the application to determine whether the API endpoint of the client API request comprises a permitted API endpoint in the whitelist, wherein comparing comprises identifying an element of the client API request, wherein the identified element comprises at least one of an endpoint path, an endpoint parameter, an endpoint parameter value, a specified method of the client API request, and a header of the client API request;
• utilizing the whitelist to determine whether the identified element is a permitted element of the client API request;
• and
• rejecting the client API request in response to determining that the identified element is not a permitted element of the client API request;
• and
• route the client API request to a target microservice of the application, in response to the whitelisting validation operation determining that the client API request is permitted.