Public Guide

How BlackShield Protects APIs and Tenant Boundaries (OWASP API Top 10: 2023)

BlackShield protects its APIs with authenticated access, role checks, rate limits on sensitive flows, and audit trails for evidence access and administrative changes. Audience: Security architects, AppSec reviewers, buyers, and compliance stakeholders. Typical setup time: 12-15 minutes.

trust

Use this if

BlackShield protects its APIs with authenticated access, role checks, rate limits on sensitive flows, and audit trails for evidence access and administrative changes.

Audience: Security architects, AppSec reviewers, buyers, and compliance stakeholdersTypical time: 12-15 minutes

Before You Begin

  • Identify the API questions the buyer or reviewer is asking about authorization and abuse controls.
  • Have the admin surfaces and `/audit` available so you can answer with product behavior.
  • Collect recent evidence for rate limiting, access control, and API review cadence.

Guide walkthrough

1

Step 1

Authentication and authorization in BlackShield

Review the specific actions, API endpoints, and administrative pages that require authentication or elevated roles.

  • Administrative routes such as `/identity`, `/tenant-rights`, and API key management require authenticated admin access.
  • Read and export permissions are split so not every user who can view data can export evidence.
  • Customer data queries run in the signed-in workspace context rather than a shared global view.

What success looks like

Customer data queries run in the signed-in workspace context rather than a shared global view.

2

Step 2

Abuse protections BlackShield already applies

Understand how BlackShield prevents abuse, brute-force requests, and destructive actions through automated rate limits.

  • Login, onboarding, token refresh, and OIDC exchange endpoints are rate-limited.
  • Identity writes, API key writes, and tenant deletion are separately rate-limited as sensitive actions.
  • Ingestion endpoints enforce tenant rate limits so one customer cannot push unlimited scan volume unchecked.

What success looks like

Ingestion endpoints enforce tenant rate limits so one customer cannot push unlimited scan volume unchecked.

3

Step 3

How BlackShield gives you proof the controls are working

Validate that security controls are functioning as intended using exported audit logs, report summaries, and compliance maps.

  • Use `/audit` to filter administrative and access events by actor, action, and time range.
  • Use identity audit in `/identity` to review OIDC and SCIM changes separately from the general audit log.
  • Use the same audit and admin surfaces during renewal or incident review so the buyer sees a repeatable control path.

What success looks like

Use the same audit and admin surfaces during renewal or incident review so the buyer sees a repeatable control path.

What success looks like

  • Reviewers can explain which BlackShield routes require admin roles and which flows are rate-limited.
  • Authorization and audit evidence can be pulled from product, not recreated manually.
How BlackShield Protects APIs and Tenant Boundaries (OWASP API Top 10: 2023) | BlackShield Docs