Enhancing software assurance for the developer community
- GuardAPI is the digital authentication signing and verification point for managing, promoting, and sharing APIs. Clients can manage the signing, deployment, and verification of products to their own developer community, or connections to communities that have adopted their platform.
- The API integrity platform is designed for both Cloud and Enterprise. APIs can be published in private repositories and with access for select groups of developers, ensuring those APIs are secure prior to publishing, while still controlling access.
API Security and Integrity Assurance
- GuardAPI lets you securely sign and authenticate your APIs, while at the same time protecting sensitive information, while also allowing access to API repositories for authorized Apps, users, and subscribers.
- Advanced Digital Signatures via KSI. Ensures the integrity of the API with continuous monitoring of APIs and associated software. Privacy is also ensured for any customer data with industry compliant encryption and KSI signatures.
- Flexible Authentication Policies. Developers and publishers leverage the power of KSI for authentication for a myriad of purposes. Generate authentication tokens and credentials wrapped in KSI containers to ensure only valid users and applications can access the APIs and associated repositories.
SLA and QoS Assurance and Management
- GuardAPI allows for true QoS management and contract guarantees for SLA Assurance. By authenticating deployed APIs and continuously monitoring their coherence. OEMs for APIs, developers, and service providers can be assured that API deliveries are in accordance with vendor baselines and configuration specifications. If there is a change to the API, deployed configuration, or associated dependencies, the vendor, the service provider, and the customer can know about it in real time.
- API administrator activities are also logged and their interactions with Sandbox and Production environment(s) are preserved across the API lifecycle via irrefutable KSI evidence and audit activities.
- 3rd Party Verification of API Integrity is afforded via KSI to ensure that service providers and App developers understand in real-time any changes to APIs prior to App access.
App Management and Workflow Security
- Developer interactions to your APIs become irrefutably logged, audited, and their interactions preserved for the lifecycle of the API. GuardAPI can use advanced monitoring of both your sandbox and production endpoints to ensure developer testing and deployment activities are preserved in accordance with subscriber contracts.
- Legal Agreement Management. Workflow approvals ensure there is developer acknowledgement of legal limitations associated with each API, associated documentation and definitions are signed by KSI and verified before their App is allowed access. Once signed and verified, App and API connections and controls become automated.
- Connections to Common API Governance and PaaS Platforms. Already using an API management and governance tool? GuardAPI connectors allow you to leverage the power of real-time integrity verification and secure API management using KSI.
- Portability of evidence. APIs and associated dependencies can be validated independent of trusting traditional PKI certificate trust anchors like PKI Certificate and Verification Authorities.
- Massive scale API and dependency authentication – with the benefits of real-time verification to support real-time incident response, sandboxing, and protection of consumer records.
- Forensic auditability. Complete chain of custody information is available via KSI evidence and GuardAPI reporting solutions. GuardVision collects API service integrity evidence and associated dependency transformations. Tag, track, and locate who is responsible for what changes in the API service layer. When, where, and by who.
- Report generation, security correlation, and visualization.. Integrate and transform KSI intelligence into your SIEM/SEM environment or using advanced data mining capabilities to report, and respond. Inspect, verify, schedule, and respond to API service compromises.
Cloud-based or On-Premise
- PaaS. Use of GuardAPI as a cloud-based API integrity service ensures APIs are deployed as quickly and securely as possible within verified boundaries and agreements as determined by the API vendor and service provider.
- On-Premise. GuardAPI can be deployed within client datacenters so that clients have complete visibility, control, and assurance of APIs to manage compliance with contracts, industry, and regulatory standards.
- Hybrid.Managed as a service GuardAPI can reside within your client datacenters or outsourced as a service via a Guardtime Authorized provider for API management and proxy. As developer communities grow, GuardAPI can manage the security and integrity of developer, service provider, and auditor iterations with automated reports, incident response, and delivery/access management.
For more details about GuardAPI PaaS options please contact [email protected]