The 42Crunch API Security Platform provides security across the API lifecycle, using the OpenAPI Specification (OAS) as a foundational contract for a positive security model. The platform conducts static analysis (API Audit) on API definitions to evaluate structural validity and security definitions, and performs dynamic conformance scanning and fuzzing (API Scan) on API implementations to test for vulnerabilities, including the OWASP API Security Top 10. It discovers APIs by crawling code repositories and integrates directly into IDEs and CI/CD pipelines to automate security testing, provide remediation guidance, and enable stage gating. The system can also validate AI-generated API code to meet security standards before deployment.
For runtime protection, the platform deploys a Micro API Firewall that enforces the defined OAS contract as an allowlist. This component inspects full API transactions in real-time, validating content and blocking requests that do not conform to the specified data structures and properties, thereby protecting against threats like injection attacks and Broken Object Level Authorization (BOLA). The lightweight micro-firewalls can be deployed in container orchestrators to protect microservices architectures and can discover shadow APIs. The system integrates with API gateways and SIEM tools for centralized policy enforcement, monitoring, and threat intelligence enrichment.
