Which of your cloud APIs are public, unauthenticated or unthrottled?
Cloud API security posture: find API gateways with no auth, throttling, WAF or TLS.
Onam API Security is API security posture management for cloud APIs. It reads the configuration of the API gateways and ingress routes in your cloud accounts and clusters, and flags the ones that are public without authentication, unthrottled, missing a WAF, not enforcing TLS or not logging. It works from configuration through read-only access and does not sit in your API traffic.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
APIs multiply faster than anything else in a cloud estate.
A team ships an API Gateway for a prototype, wires it to a Lambda, disables the authoriser 'just for testing', and moves on. Two years later it is still public, still unauthenticated, still has no WAF, still has no logging. It is also one of the cheapest ways into your account. Nobody removed it because nobody knew it was still there.
How API Security Posture works
- 01
Onam reads API resources from the cloud inventory it already collects through read-only roles: AWS API Gateway REST and HTTP APIs, stages and API keys; Azure API Management; Google API Gateway and Apigee; OCI API Gateway; Alibaba Cloud API Gateway; and Kubernetes Ingress and Gateway API objects.
- 02
Posture rules in the application and API domain (241 in the rule catalogue) check authentication and authorisers, usage plans with rate, burst and quota limits, request validation, access logging and tracing, private networking, and Lambda function URL authentication and CORS.
- 03
Gateway-specific checks then look at each API in context. On AWS: a public stage with no authoriser, no throttling or no WAF web ACL; API keys older than 90 days; a backend integration that points at a private IP range or a cloud metadata endpoint (an SSRF pivot); missing mutual TLS; exposed GraphQL APIs; and sensitive fields in an attached OpenAPI definition.
- 04
On the other clouds: Azure API Management without an auth policy, rate-limit policy or WAF; Apigee environments without an auth or quota policy; OCI deployments without authentication or rate limiting, gateways without TLS enforcement, and wildcard CORS; Alibaba API groups that are not HTTPS-only or lack traffic control; Kubernetes ingresses without TLS or an auth annotation, and gateways without an HTTPS listener.
- 05
Each finding names the API resource, a severity and a remediation step. Depth varies by cloud: AWS API Gateway has the widest set of checks today.
What you see in the console
- An inventory of gateway-managed APIs across AWS, Azure, GCP, OCI, Alibaba Cloud and Kubernetes
- Public endpoints with no authentication or authoriser
- Missing rate limiting, burst limits and quotas
- WAF coverage gaps on AWS API Gateway stages and Azure API Management
- TLS, HTTPS-only and mutual TLS gaps
- Access logging and tracing coverage
- Ageing API keys and backend integrations that reach private addresses or metadata endpoints
- APIs whose name or version marks them as legacy, beta or test, still live
API Security Posture in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See API Security Posture on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.