SAP API Management
SAP API Management proxies APIs and protects them with per-flow, developer-configured policies (Verify API Key, OAuth, Access Control, Spike Arrest/quota). It is built on Apigee Edge, so its misconfiguration classes are the well-known Apigee ones - and because enforcement is per-flow rather than global, an auth policy attached in the wrong place leaves an unauthenticated path.
Because policy enforcement is per-flow, a security policy attached only to the ProxyEndpoint PreFlow but not to a specific conditional flow - or a Spike Arrest placed after the backend call - leaves an unauthenticated or unthrottled route to the backend. API keys are long-lived shared secrets visible in the Developer Portal.
- Policy bypass via misattached policy: attaching the auth policy only to the ProxyEndpoint PreFlow but not a specific conditional flow - or placing Spike Arrest after the backend call - leaves an unauthenticated or unthrottled path. Test: exercise each proxy’s routes for a path where the auth policy does not fire; check rate-limit ordering and whether keys are per-product and rotatable.
- API key exposure: API keys are long-lived shared secrets visible in the Developer Portal - check whether keys are per-product (blast-radius-limited) or shared, and whether they are rotatable.
- Attach security policies at the ProxyEndpoint PreFlow (all routes) and test negative cases.
- Place Spike Arrest/quota before the backend call.
- Rotate API keys; prefer OAuth over bare API keys for sensitive products.
- Monitor API Management analytics for anomalous callers and for routes hit without an auth challenge.
- Subject to the BTP Audit Log’s coverage limits - see BTP Audit Blind Spots.