PRODUCT BRIEF

Cloudflare API Gateway
Manage and secure the APIs that drive business

Modern API challenges
In attacker crosshairs
APIs make the world go around. 58% of dynamic HTTP
traffic on the Cloudflare network is API-related.
APIs present exciting business opportunities to deliverproducts faster and improve customer experience.
Now, security and IT leaders have to balance securing
their APIs, on top of their web apps, without slowing
down innovation.
Security and IT teams need to secure their customers’sensitive data while enabling business operations
across web app and API properties.
Customer trust is at stake, after all.

Cloudflare API Gateway
Customers can discover, secure and simplify their
public API security and management by consolidating
their web application and API protection on theCloudflare edge.
API Gateway is part of Cloudflare's application security
portfolio that also stops bots, thwarts DDoS attacks,
blocks application attacks and monitors for supply
chain attacks.

Shadow API risks
Development teams often
publish new APIs without telling
IT, so APIs are operating in the
shadows without management
or security.

Authentication, data loss andabuse concerns
Once APIs are discovered, theymust be secured from attacks
and abuse with authentication,
schema validation, API abuseprotections, and data
exfiltration detections.

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

API performance monitoring
Given APIs drive business, once
APIs are monitored andsecured, companies must keep
an eye on their performance:
understand request volumes perendpoint, error rates, latency.

REV:PMM-JULY 2023

PRODUCT BRIEF

Cloudflare API Gateway
Manage and secure the APIs that drive business

Key Capabilities
API Management
Discovery and schema learning

Discover API endpoints in active use and their associated schemas through machine learning driven
and heuristics based models

Sequence and performance
analytics

Uncover the most important sequences of API request behavior and analyse API endpoint performance(e.g.: requests, latency, error rate, and response size, etc)

Developer portal &management

Manage interactive API documentation and host it on your domain with Cloudflare Pages

API Security
Authentication validation

Authenticate and validate API traffic with mTLS certificates, JSON web tokens (JWT), API keys, andOAuth 2.0 tokens to block requests from illegitimate clients.

Schema validation

Use API schemas to accept valid API requests and block malformed requests and HTTP anomalies.
This complements Cloudflare WAF’s negative security model for comprehensive security

Abuse detection

Baseline your traffic and stop abuse with per-endpoint session-based Rate Limiting suggestions andGraphQL denial of service (DoS) protections

Sensitive data detection

Detect sensitive data within API responses leaving your origin and alert per-endpoint

Integrated platform

All application security (Web Application Firewall, Bot Management, API security and management,
Page Shield, mTLS) is managed through an integrated console.

Product benefits
Minimize attack
surface risks andreduce cyber risk

Improve APIperformance

Reduce operationalburden - time andcosts

Consolidate on aunifiedperformance andsecurity platform
across web apps
and APIs

REV:PMM-JULY 2023

Cloudflare | API Gateway

Figure 1: Cloudflare API Gateway Architecture

Cloudflare Leadership
The Cloudflare application security portfolio has received
numerous accolades for its strength and breadth. Gartner
named Cloudflare a leader in the 2022 Gartner® MagicQuadrant™ for Web Application and API Protection (WAAP).
Forrester named Cloudflare a leader in the 2022 Forrester Wave
for Web Application Firewalls.

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-JULY 2023