ContactSign in

Web Application and API Protection (WAAP)

Azion Web Application and API Protection (WAAP) protects applications and APIs delivered through the Azion Web Platform. This page describes Azion’s mTLS capabilities for origin authentication and the WAAP capabilities for API security: discovery, inventory control, and schema validation.

mTLS capabilities for origins; key management and rotation

Azion supports Mutual TLS (mTLS) to authenticate connections between clients, the edge, and protected applications using digital certificates. Authentication is based on X.509 certificates and Trusted CAs: the certificate chain of trust is validated and only authorized identities are accepted.

Certificates are managed centrally in Azion Certificate Manager, which registers, associates, updates, and controls the certificates used in mTLS policies. Certificates can be replaced periodically, so credentials rotate without changes to the protected application.

The following attributes of the client certificate are available to security policies and can be forwarded to the origin application:

  • Fingerprint
  • Subject DN
  • Issuer
  • Serial number
  • Validity period

Automatic API discovery (API Discovery)

API Discovery automatically discovers and maps the APIs exposed and used by protected applications, based on their traffic.

For each API, discovery identifies:

  • Endpoints
  • HTTP methods
  • Request patterns and other traffic characteristics

The result is a continuously updated inventory of the APIs in use, including APIs that aren’t documented or weren’t previously known (Shadow APIs). The inventory serves as input for monitoring, security analysis, and protection policies.

Shadow / Zombie API control

Using API Discovery data, Azion WAAP identifies and monitors two categories of API exposure:

  • Shadow APIs: APIs that are undocumented, unknown, or in use outside the official inventory.
  • Zombie APIs: legacy endpoints, or endpoints that should have been deactivated but still respond.

Both categories can be monitored, analyzed, and covered by protection policies. This makes it possible to detect unauthorized exposure, reduce the attack surface, and keep the API lifecycle under control.

Validation against OpenAPI/Swagger schema

Azion WAAP validates incoming requests against the API contract defined in an OpenAPI/Swagger schema. Each request is compared with the specification expected for the API it targets.

Validation covers:

  • Endpoints
  • HTTP methods
  • Parameters
  • Headers
  • Request structure and content

Requests that don’t conform to the schema can be blocked or handled by protection policies, preventing calls outside the defined contract, including malformed requests and misuse of endpoints.