# US 12,003,543 B1 · Method and system for modifying and validating API requests

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,543 B1
- Document ID: US12003543B1
- Status: Granted
- Kind: B1
- Application number: 17/239,316
- Filed: 2021-04-23
- Granted: 2024-06-04
- Earliest claimed: 2020-07-24
- Assignees: Styra, Inc.
- Applicants: Styra, Inc.
- Inventors: Sayed Asad Ali; Andrew Curtis; Marco Sanvido; Timothy L. Hinrichs; Teemu Koponen
- Web page: https://patentgrep.com/patent/US12003543B1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 9/541: {via adapters, e.g. between incompatible applications}
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Some embodiments of the invention provide a method of modifying and validating API requests received at an API server. At a mutating admission controller of the API server, the method intercepts an API request received at the API server. The method invokes a mutating webhook to query a policy agent that includes a set of policies for modifying API requests to determine whether the API request requires modifications. When the policy agent determines that the API request requires modifications based on an identified policy from the set of policies, the method performs the modifications and forwards the modified API request for validation by the API server. After the API server has validated the API request, the method intercepts the API request at a validating admission controller and invokes a validating webhook to query the policy agent to determine whether the API request is valid. When the policy agent determines that the API request is valid, the method forwards the API request to be admitted to a database of the API server.

## Claims

### Claim 1

A method for processing API (application programming interface) requests received at an API server, the method comprising:
at a mutating admission controller of the API server,
intercepting an API request received at the API server;
invoking a mutating webhook to query a policy agent to determine whether the API request requires modifications, wherein the policy agent comprises a set of policies for modifying API requests received at the API server; and
when the policy agent determines that the API request requires modifications based on an identified policy from the set of policies, performing the modifications to the API request according to the identified policy.

### Claim 2 (depends on 1)

The method of claim 1, wherein performing the modifications to the API request according to the identified policy comprises (i) receiving a patch to be applied to the API request from the mutating webhook, and (ii) applying the patch to the API request, wherein the patch comprises the modifications.

### Claim 3 (depends on 2)

The method of claim 2, wherein after performing the modifications, the mutating admission controller sends the modified API request to the API server for validation.

### Claim 4 (depends on 1)

The method of claim 1, wherein
the mutating admission controller is a mutating first admission controller, the mutating webhook is a mutating first webhook, the query is a first query, and the set of policies is a first set of policies,
after the API request is validated by the API server, the API request is sent to a validating second admission controller, and
upon receiving the API request, the validating second admission controller invokes a validating second webhook that sends a second query to the policy agent to determine whether the API request is valid based on a second set of policies for validating API requests.

### Claim 5 (depends on 4)

The method of claim 4, wherein
when the policy agent determines that the API request is valid, the API request is admitted to a storage structure of the API server to complete the request, and
when the policy agent determines that the API request is not valid, the validating second admission control returns the API request to the mutating admission controller to determine whether initial or additional modifications are required to make the API request valid.

### Claim 6 (depends on 4)

The method of claim 4, wherein the second set of policies comprises custom default validation policies.

### Claim 7 (depends on 4)

The method of claim 4, wherein the mutating first webhook is configured to query a first specific document from the policy agent and the validating second webhook is configured to query a second specific document from the policy agent.

### Claim 8 (depends on 4)

The method of claim 4, wherein the first and second admission controllers comprise first and second admission control plugins.

### Claim 9 (depends on 1)

The method of claim 1, wherein when the policy agent determines that the request does not require modifications, the mutating admission controller sends the API request to the API server for verification without performing modifications.

### Claim 10 (depends on 1)

The method of claim 1, wherein the mutating admission controller receives the API request after the API server has authenticated and authorized the API request.

### Claim 11

A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for processing API (application programming interface) requests received at an API server, the program comprising sets of instructions for:
at a mutating admission controller of the API server,
intercepting an API request received at the API server;
invoking a mutating webhook to query a policy agent to determine whether the API request requires modifications, wherein the policy agent comprises a set of policies for modifying API requests received at the API server; and
when the policy agent determines that the API request requires modifications based on an identified policy from the set of policies, performing the modifications to the API request according to the identified policy.

### Claim 12 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein performing the modifications to the API request according to the identified policy comprises sets of instructions for (i) receiving a patch to be applied to the API request from the mutating webhook, and (ii) applying the patch to the API request, wherein the patch comprises the modifications.

### Claim 13 (depends on 12)

The non-transitory machine readable medium of claim 12, wherein after performing the modifications, the mutating admission controller sends the modified API request to the API server for validation.

### Claim 14 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein
the mutating admission controller is a mutating first admission controller, the mutating webhook is a mutating first webhook, the query is a first query, and the set of policies is a first set of policies,
after the API request is validated by the API server, the API request is sent to a validating second admission controller, and
upon receiving the API request, the validating second admission controller invokes a validating second webhook that sends a second query to the policy agent to determine whether the API request is valid based on a second set of policies for validating API requests.

### Claim 15 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein
when the policy agent determines that the API request is valid, the API request is admitted to a storage structure of the API server, and
when the policy agent determines that the API request is not valid, the validating second admission control returns the API request to the mutating admission controller to determine whether initial or additional modifications are required to make the API request valid.

### Claim 16 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the second set of policies comprises custom default validation policies.

### Claim 17 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the mutating first webhook is configured to query a first specific document from the policy agent and the validating second webhook is configured to query a second specific document from the policy agent.

### Claim 18 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the first and second admission controllers comprise first and second admission control plugins.

### Claim 19 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein when the policy agent determines that the request does not require modifications, the mutating admission controller sends the API request to the API server for verification without performing modifications.

### Claim 20 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the mutating admission controller receives the API request after the API server has authenticated and authorized the API request.