When it comes to internal APIs, it really depends on what you mean by 'internal.' We frequently hear people referring to APIs exposed over the internet to their own organization's web and mobile applications as 'internal APIs.' And while the documentation for these APIs may indeed be accessible only by company employees and contractors, hackers have become very adept at analyzing apps and reverse engineering the APIs serving them via app disassembly toolkits and proxies such as Burp Suite.
However, if by 'internal APIs' you mean east-west APIs which cannot be accessed from outside the organization, then the main threat is reduced to insider threat.
Protect your internal APIs (in the former sense of the word) and your business-to-business (B2B) APIs as you would most APIs: Start by securing your software development lifecycle (SSDLC), continue by ensuring authenticated and authorized access, manage quotas, rate limits and spike arrests, and protect against known signatures with WAFs/WAAPs.
For B2B APIs, due to the sensitive and often bulk nature of the transactions, consider adding - if possible - strict authentication mechanisms such as mTLS.
And for both - we recommend you employ behavioral analytics, especially if you have many entities involved, which may make the process of distinguishing between legitimate and illegitimate behavior hard.