API Security: support reference¶
Internal. The customer-facing explanation is in Reading the API Security screens and the screen reference.
API Security looks like Application Security and is a separate module with its own masters. Assuming the two behave identically causes most of its tickets.
It is not Application Security with a different name¶
| Application Security | API Security | |
|---|---|---|
| Asset | An application | An API asset — a collection of endpoints |
| Identified by | URL or package | Base URL, usually versioned |
| Finding attached to | The application | The API asset, often a specific endpoint |
| Status lists | Its own | Its own, different ones |
The status masters are genuinely separate: API Security ships fourteen audit statuses, five validation statuses and fourteen client statuses, and they are not the same list as AppSec's. A support answer that quotes an AppSec status may name a value this module does not have.
Exports built for the wrong module¶
Because the two modules hold the same concept under different names beneath the surface, a report or export template built against Application Security does not carry API Security's status column, and vice versa.
"The export is missing its status" is nearly always a template built against the other module. Rebuild it against the module being exported rather than editing the output.
Versioned assets¶
An API asset is usually versioned, and v1 and v2 are separate assets. Findings do not move between them, and a customer who has "fixed it in v2" still has an open finding on v1 until v1 is decommissioned.
Counts that look duplicated across versions are usually correct.
Endpoint-level findings¶
A finding often names a specific endpoint rather than the whole asset. Two findings on the same asset with the same title and different endpoints are two findings, not a duplicate.
Artifacts are permission-gated¶
The Artifacts column shows a view control only to roles holding the API proof-of-concept permission. For everyone else the column is present and empty — the control is absent rather than disabled, so it reads as missing evidence rather than as a permission.
Confirm the caller's role before treating an empty Artifacts column as lost data.
The same platform rules apply¶
- Nothing counts until Validation reaches Approved; Discovered On is blank until then.
- Only considered audits reach dashboards.
- Only two statuses close a finding.
- An audit counts on the date it reached a final state.
What to collect before escalating¶
- Audit ID and API asset, including the version.
- The exact Validation and Current Status values — quoted, because this module's lists differ from AppSec's.
- Whether the audit is considered.
- For export complaints: which module the template was built against.
- For missing artifacts: the caller's role.