Design API Security - System Design | WinJob

Problem Statement & API Attack Surface

API security for enterprise platforms is a continuous control plane, not a one-time WAF rule. Companies like Salt Security, Noname Security, and Akamai sell discovery plus runtime protection because shadow APIs and token abuse scale faster than manual reviews. This section focuses on attack surface within that frame.

Mechanisms that matter

North-south APIs are the primary breach vector for modern SaaS
OWASP API Top 10 maps directly to control categories you must name
Salt/Noname-class platforms discover shadow APIs before attackers do

Design reasoning (sec1-attack-surface)

When interviewers probe attack surface, they expect you to connect controls to measurable outcomes: blocked credential stuffing attempts, reduced BOLA findings in pen tests, and policy publish SLAs under one minute. Tie each decision to OWASP API Security Top 10 categories—especially API1:2023 Broken Object Level Authorization, API2:2023 Broken Authentication, and API8:2023 Security Misconfiguration.

For Problem Statement & API Attack Surface, quantify assumptions: 160K–480K RPS north-south ingress, ≤25 ms added security latency p99, and 960 MB/s security telemetry at peak. Explain fail-closed behavior for privileged routes when the policy engine is degraded, and fail-open never for token validation.

Implementation sketch

javaOne Dark Pro

1 public final class ApiSecCtx1 {
2   private final String tenantId;
3   private final long policyBundleVersion;
4   private final String routeTemplate;
5   public String decisionCacheKey(String subject, String scope) {
6     return tenantId + "|" + policyBundleVersion + "|" + routeTemplate + "|" + subject + "|" + scope;
7   }
8   public boolean isBundleStale(long liveVersion) {
9     return policyBundleVersion < liveVersion;
10   }
11 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class ApiSecurityDecision1:
5     tenant_id: str
6     bundle_version: int
7     route_template: str
8     subject: str
9     allow: bool
10     rule_id: str

typescriptOne Dark Pro

1 interface ApiSecCtx1 {
2   tenantId: string;
3   bundleVersion: number;
4   routeTemplate: string;
5   subject: string;
6   scopes: string[];
7 }
8  
9 export function cacheKey(c: ApiSecCtx1): string {
10   return [c.tenantId, c.bundleVersion, c.routeTemplate, c.subject, c.scopes.join(",")].join("|");
11 }

Operational checklist (attack surface)

1.1: Export allow/deny ratio per route template to detect misconfigured authZ.
1.2: Alert when shadow API traffic exceeds 0.1% of RPS for a tenant.
1.3: Run chaos tests: policy engine unavailable during peak—verify admin fail-closed.
1.4: Sample JWT validation failures by kid rotation canary before full JWKS swap.
1.5: Track schema validation 422 spikes as potential attack or client bug.
1.6: Correlate 429 bursts with risk score changes for bot tuning.
1.7: Measure policy publish duration p99; block releases >60s propagation.
1.8: Store HMAC webhook clock skew violations for replay investigation.
1.9: Review mTLS cert expiry 30 days ahead for partner onboarding.
1.10: Pen-test BOLA on top 20 object routes quarterly.

Close attack surface with numbers: ingress RPS, added latency budget, audit ingest MB/s, and which OWASP API category you mitigated—not generic "we use OAuth."

Why interviewers care

API Security interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & API Attack Surface that proves you understand real outages, not happy-path diagrams.

Key Highlights

•North-south APIs are the primary breach vector for modern SaaS
•OWASP API Top 10 maps directly to control categories you must name
•Salt/Noname-class platforms discover shadow APIs before attackers do

1	public final class ApiSecCtx1 {
2	private final String tenantId;
3	private final long policyBundleVersion;
4	private final String routeTemplate;
5	public String decisionCacheKey(String subject, String scope) {
6	return tenantId + "\|" + policyBundleVersion + "\|" + routeTemplate + "\|" + subject + "\|" + scope;
7	}
8	public boolean isBundleStale(long liveVersion) {
9	return policyBundleVersion < liveVersion;
10	}
11	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class ApiSecurityDecision1:
5	tenant_id: str
6	bundle_version: int
7	route_template: str
8	subject: str
9	allow: bool
10	rule_id: str

1	interface ApiSecCtx1 {
2	tenantId: string;
3	bundleVersion: number;
4	routeTemplate: string;
5	subject: string;
6	scopes: string[];
7	}
8
9	export function cacheKey(c: ApiSecCtx1): string {
10	return [c.tenantId, c.bundleVersion, c.routeTemplate, c.subject, c.scopes.join(",")].join("\|");
11	}