Protecting against api attacks by continuous auditing of security compliance of api usage relationship

A computer program product for protecting against application programming interface (API) attacks, the computer program product comprising one or more computer readable storage mediums having program code embodied therewith, the program code comprising programming instructions for:

• establishing a connection between an API user and an API provider;
• monitoring said connection to assess connection security and trustworthiness of said connection as well as trustworthiness of one or more of said API user and said API provider;
• generating a score for each factor used in assessing said connection security and said trustworthiness of said connection as well as said trustworthiness of one or more of said API user and said API provider based on said monitoring to indicate connection insecurity, untrustworthiness of said connection, untrustworthiness of said API user or untrustworthiness of said API provider;
• generating a level of risk for an API attack with respect to one or more of said API user and said API provider based on said generated score for each factor used in assessing said connection security and said trustworthiness of said connection as well as said trustworthiness of one or more of said API user and said API provider;
• and
• performing an action with respect to one or more of said API user and said API provider based on said level of risk for said API attack with respect to one or more of said API user and said API provider, respectively.

A system, comprising:

• a memory for storing a computer program for protecting against application programming interface (API) attacks;
• and
• a processor connected to said memory, wherein said processor is configured to execute program instructions of the computer program comprising:
• establishing a connection between an API user and an API provider;
• monitoring said connection to assess connection security and trustworthiness of said connection as well as trustworthiness of one or more of said API user and said API provider;
• generating a score for each factor used in assessing said connection security and said trustworthiness of said connection as well as said trustworthiness of one or more of said API user and said API provider based on said monitoring to indicate connection insecurity, untrustworthiness of said connection, untrustworthiness of said API user or untrustworthiness of said API provider;
• generating a level of risk for an API attack with respect to one or more of said API user and said API provider based on said generated score for each factor used in assessing said connection security and said trustworthiness of said connection as well as said trustworthiness of one or more of said API user and said API provider;
• and
• performing an action with respect to one or more of said API user and said API provider based on said level of risk for said API attack with respect to one or more of said API user and said API provider, respectively.