Endpoint Details

This tab provides an overview and details of the various parameters used in an API as well as their location and sensitivity. The Parameters tab also includes information about the datatypes and datasets associated with a parameter. This is useful for gaining in-depth insights into your API activity and understanding the criticality of parameters.

Note

Parameters are not generated for third-party APIs.

The visualization section in the tab provides information about the following:

• Parameters by Location — Displays a chart showing the total number of parameters discovered in different sections of an API request or response, with each location represented in a different color.

• Parameters by Sensitivity — Displays a chart showing the total number of parameters discovered in an API request or response, grouped by sensitivity and represented in different colors.

  Note

  Parameters that are not associated with a datatype are not assigned a sensitivity (None) as shown above.

The tab also displays a list of parameters that Traceable has discovered in the API request and response. By default, Traceable displays the list of parameters that it has learned. The following details are shown for each parameter:

• Parameter — The name of the parameter discovered by Traceable. Objects containing multiple child parameters or objects are represented by {}. You can click the Expand () icon corresponding to an object to view the parameters under it. The icon next to a parameter name indicates the type of value sent in that parameter. You can hover over the icon to view the type, for example, ABC, which represents a String.
  

  

• Is Required — Highlights whether the parameter is required or not. Traceable marks a parameter as required if it appears in 99% of API calls. Required parameters are highlighted with an asterisk (*) as shown above.

• Location — The location within the request or response of the API where Traceable observed the parameter, for example, body, header, etc.

• Datatypes — The Traceable datatype(s) associated with the parameter, for example, password and Email as shown above. You can also hover over a datatype to view its basic details.
  You can add or edit datatypes for each parameter according to your requirements by clicking the Ellipse () icon corresponding to a row and selecting Add Datatype or Manage Datatype, respectively. Specify or modify the datatype details in the respective pop-up window according to your requirements. For detailed information on these fields, see Data Classification.

  Note

  • You can add or edit datatypes only at a parameter level and not at an object () level. Therefore, you must expand objects to be able to add or edit datatypes. For example, in the above screenshot, the object level is represented by {} in the first row, and upon expanding, the parameter level is represented by the child rows password and email.

  • A datatype can belong to one or more datasets. Make sure that the dataset to which you want to add the datatype is available in the Dataset drop-down list. If it is not listed, then create a dataset from Settings () → Discovery → Data Classification → Datasets tab. For more information, see Data Classification.

• Datasets — The Traceable dataset(s) associated with the parameter, for example, Generic Auth and HIPAA as shown above. You can also hover over a dataset to view the corresponding datatypes under it.

• Is Learnt — Highlights whether the parameter is learned or not. While Traceable shows learned parameters by default, you can remove the Is Learnt filter at the top of the tab to view both learned and under-learning parameters. The learned and under-learning parameters are highlighted using the and icons respectively.

• Identified In — The API component (request or response) where Traceable observed the parameter.

Note

As Traceable keeps monitoring both learned and under-learning APIs continuously, the parameters visible in the tab may change with time.

You can also do the following in the tab:

• Search for a specific parameter using the Search bar.

• Filter data to view parameters based on certain conditions by clicking the Filter () icon.

This tab highlights the malicious activities observed in the API within your selected time duration. The page contains the following information:

• The type of malicious behavior observed in the API.

• The description of the malicious behavior.

• The category to which the behavior belongs.

• The timestamp at which the behavior was observed.

You can click on a specific behavior to view its details. Traceable redirects you to the Threat Activity page under Protection, where you can view information such as event details, description, mitigation, impact, etc.

When a user sends a request, it creates a trace in the system. A trace may traverse through multiple services to fulfill the user’s request. The Traces tab displays detailed information about each request, including its response and associated attributes. Traceable also shows the related cookies.

One crucial piece of information the Traces tab provides is the Exit Calls. This information lets you identify the backend or third-party services your API is calling, which can be especially helpful for detecting unauthorized third-party calls. You can also click on the + icon corresponding to a row to view more details about the trace.

The Metrics tab displays detailed statistical information about the API endpoint's performance. By default, this information is shown for the past 5 minutes; however, you can change it to view data for up to 6 hours. The following information is displayed for an API:

• Performance information, such as P50, P95, and P99 latency numbers. These metrics help identify the API performance for different user groups. If you encounter unexpected latency numbers, consider checking the APIs for resource consumption, performance bottlenecks, and network issues.

• The error rate and error percentage during the selected time period. The error rate is the number of failed requests per second, while the error percentage is the number of failed requests relative to the total number of requests, expressed as a percentage. These values help detect issues and monitor the API’s reliability. If you encounter unexpected numbers, consider checking the APIs for network issues, security problems, and configuration errors.

• The number of calls per minute to the API during the selected period. If you notice an unusually high number of calls to an API, it may indicate API abuse or a DDoS attack.

• The data transfer rate during the selected period can also provide insights into the API’s usage. If you encounter an unexpected data transfer rate for an API that should have a low rate, it may indicate a potential breach in API security.

• The top status codes that you can monitor to infer the health of the API. You may want to check the API for issues if you see many error status codes.

The Risk score is calculated based on the likelihood and impact of a probable security breach. The Risk tab displays the current risk score, calculated based on various sub-components of likelihood and impact. For detailed information on how Traceable calculates the score, see Risk Score.