An API architecture's real attack surface is every endpoint a valid-looking but malicious request stream can reach before the gateway's checks catch it.
blocked if auth_strength > request_risk
risk rises with anomalous request rate
- API endpoints — individual REST/GraphQL endpoints exposed by the architecture.
- Endpoint interconnection — how many downstream endpoints a single compromised token could reach.
- Request rate — incoming traffic volume, including any credential-stuffing burst.
- Auth strength — how rigorous token validation and rate-limiting are at the gateway.
Broken Object Level Authorization and weak rate-limiting remain the OWASP API Top 10's most exploited issues — this sim shows why gateway auth strength matters so much.