Implement API security testing in CI/CD pipelines
Implementation Effort: High – Standing up specification validation and automated security testing across every API-exposing service is a large, sustained effort spanning application and pipeline teams. User Impact: Low – Adding API security testing to pipelines is a build-time action for pipeline owners; end users are not affected. Lifecycle Stage: Build
Overview
Integrate API security testing into CI/CD pipelines for services that expose APIs, using specification validation and automated security testing before deployment.
APIs are the primary attack surface for modern applications. They expose business logic, handle authentication, process sensitive data, and often have a larger footprint than web user interfaces. Without dedicated API security testing, vulnerabilities such as broken object-level authorization, excessive data exposure, mass assignment, and injection flaws remain undetected until they are discovered in production.
Require each HTTP API to maintain an up-to-date OpenAPI specification in the repository where practical. For protocols that do not use OpenAPI, maintain an equivalent machine-readable contract and security test inputs. Validate the specification during build, then run API-focused security tests against a staging or ephemeral environment by using tools such as OWASP ZAP API Scan or an equivalent commercial service. In GitHub Actions, that can mean running the ZAP API scan action against an ephemeral test endpoint; in Azure Pipelines, run the scan in a dedicated stage or container job and publish the report as a pipeline artifact for triage. Feed those results into the same triage workflow used for SAST and SCA so API findings are prioritized and remediated with the rest of the DevSecOps backlog.
If the organization publishes APIs through Azure API Management, optionally enable Microsoft Defender for APIs for runtime visibility and threat detection after deployment. Treat that as an Azure-specific runtime enhancement, not the core control. The primary requirement for both GitHub and Azure DevOps delivery pipelines is pre-production API specification validation and automated API security testing. Validating and testing each API before deployment supports Verify explicitly, since every exposed interface must pass specification and security checks rather than being trusted once it reaches production.