V13 - API

Ensure that a verified application that uses trusted service layer APIs (commonly using JSON or XML or GraphQL) has:

• Adequate authentication, session management and authorization of all web services.

• Input validation of all parameters that transit from a lower to higher trust level.

• Effective security controls for all API types, including cloud and Serverless API

Please read this chapter in combination with all other chapters at this same level; we no longer duplicate authentication or API session management concerns.