--- description: Discover, validate, and protect API endpoints with API Shield security features. title: Security image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/api-shield/llms.txt > Use this file to discover all available pages before exploring further. # Security Last updated Aug 27, 2026|Copy as Markdown|[View as Markdown](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/index.md)|[Agent setup](https://6a6c61b9.previews.developers.cloudflare.com/agent-setup/) [Application Profiles](https://6a6c61b9.previews.developers.cloudflare.com/waf/detections/application-profiles/) provides the shared profile detection, analytics, and mitigation model. Schema Profile is its only current profile type. [Schema Learning](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/) learns a Schema Profile from traffic. [Schema Validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/) supplies the same profile type through uploaded OpenAPI schemas. API Shield provides API inventory, schema governance, OpenAPI export, and automation. Cloudflare also offers these API security features: | Discovery & management | Posture management | Runtime protection | | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | [API Discovery](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/api-discovery/) | [Volumetric Abuse Detection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/volumetric-abuse-detection/) | [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/) | | [Schema learning](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/) | [Authentication Posture](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/authentication-posture/) | [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/) | | [Sequence Analytics](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-analytics/) | [BOLA vulnerability detection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/bola-vulnerability-detection/) | [Sequence mitigation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-mitigation/) | | | [Risk labels](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-labels/#risk-labels) | [Mutual TLS (mTLS)](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/mtls/) | | | [Vulnerability Scanner](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/vulnerability-scanner/) | [GraphQL query protection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/graphql-protection/) | ## Example Cloudflare solutions Cloudflare API Shield, together with other Cloudflare products, helps protect your API from the [OWASP API Security Top 10 ↗](https://owasp.org/www-project-api-security/). These are the most common API security risks, ranging from unauthorized data access to denial of service. The following table maps each OWASP vulnerability to the Cloudflare features that address it: | OWASP issue | Example Cloudflare solution | | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Broken Object Level Authorization | [BOLA vulnerability detection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/bola-vulnerability-detection/), [Sequence mitigation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-mitigation/), [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/), [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/), [Rate Limiting](https://6a6c61b9.previews.developers.cloudflare.com/waf/rate-limiting-rules/), [Vulnerability Scanner](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/vulnerability-scanner/) | | Broken Authentication | [Authentication Posture](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/authentication-posture/), [mTLS](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/mtls/), [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/), [Exposed Credential Checks](https://6a6c61b9.previews.developers.cloudflare.com/waf/managed-rules/check-for-exposed-credentials/), [Bot Management](https://6a6c61b9.previews.developers.cloudflare.com/bots/) | | Broken Object Property Level Authorization | [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/), [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/) | | Unrestricted Resource Consumption | [Rate Limiting](https://6a6c61b9.previews.developers.cloudflare.com/waf/rate-limiting-rules/), [Sequence mitigation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-mitigation/), [Bot Management](https://6a6c61b9.previews.developers.cloudflare.com/bots/), [GraphQL Query Protection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/graphql-protection/) | | Broken Function Level Authorization | [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/), [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/) | | Unrestricted Access to Sensitive Business Flows | [Sequence mitigation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-mitigation/), [Bot Management](https://6a6c61b9.previews.developers.cloudflare.com/bots/), [GraphQL Query Protection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/graphql-protection/) | | Server Side Request Forgery | [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/), [WAF managed rules](https://6a6c61b9.previews.developers.cloudflare.com/waf/managed-rules/), [WAF custom rules](https://6a6c61b9.previews.developers.cloudflare.com/waf/custom-rules/) | | Security Misconfiguration | [Sequence mitigation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/sequence-mitigation/), [Schema validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/schema-validation/), [WAF managed rules](https://6a6c61b9.previews.developers.cloudflare.com/waf/managed-rules/), [GraphQL Query Protection](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/graphql-protection/) | | Improper Inventory Management | [Discovery](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/api-discovery/), [Schema learning](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/) | | Unsafe Consumption of APIs | [JWT validation](https://6a6c61b9.previews.developers.cloudflare.com/api-shield/security/jwt-validation/), [WAF managed rules](https://6a6c61b9.previews.developers.cloudflare.com/waf/managed-rules/) | Was this helpful? YesNo ## On this page [![](https://6a6c61b9.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://6a6c61b9.previews.developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://developers.cloudflare.com/api-shield/security/#page","headline":"Security · Cloudflare API Shield docs","description":"Discover, validate, and protect API endpoints with API Shield security features.","url":"https://developers.cloudflare.com/api-shield/security/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-27","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ```