Automatic assessment of API service security standing with API reputation scoring

A method, comprising:

• identifying an API service called by an application based on information provided by an agent embedded within the application, wherein the agent comprises a software module embedded within the application and the agent is configured to interact with data plane traffic between the application and the API service;
• collecting telemetry associated with the API service, the telemetry collected from one or more telemetry sources and indicating any deficiencies in the API service;
• generating a reputation score for the API service based on analysis of the collected telemetry;
• and
• transmitting the reputation score to at least one of the following:
• the agent embedded within the application, wherein the reputation score is associated with at least one policy having at least one policy action, and wherein the reputation score is operable to be used by the agent to invoke the at least one policy action relating to use of the API service by the application;
• or
• a continuous integration/continuous delivery (CI/CD) pipeline associated with the application, wherein the reputation score is operable to be used by the CI/CD pipeline to determine deployment policies of the application.

One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause performance of operations comprising:

• identifying an API service called by an application based on information provided by an agent embedded within the application, wherein the agent comprises a software module embedded within the application and the agent is configured to interact with data plane traffic between the application and the API service;
• collecting telemetry associated with the API service, the telemetry collected from one or more telemetry sources and indicating any deficiencies in the API service;
• generating a reputation score for the API service based on analysis of the collected telemetry;
• and
• transmitting the reputation score to at least one of the following:
• the agent embedded within the application, wherein the reputation score is associated with at least one policy having at least one policy action, and wherein the reputation score is operable to be used by the agent to invoke the at least one policy action relating to use of the API service by the application;
• or
• a continuous integration/continuous delivery (CI/CD) pipeline associated with the application, wherein the reputation score is operable to be used by the CI/CD pipeline to determine deployment policies of the application.