API Endpoints: The Overlooked DDoS Target

Your API costs $0.50 per request to process. An attacker's request costs $0.0001 to send.

That 5,000x cost asymmetry is why APIs have become the preferred target for sophisticated DDoS attacks. While web pages can be cached and served from CDN edge nodes, API requests often hit your origin servers directly - every single time.

And here's the uncomfortable truth: most organizations protect their marketing website better than their revenue-generating APIs.

Why APIs Are Different

Traditional DDoS protection was designed for websites. APIs break those assumptions:

The API Attack Surface

Modern API architectures expose multiple attack vectors:

1. Public API Endpoints

Any endpoint documented in your API docs is a known target. Attackers don't need to discover anything - you've published the blueprint.

2. Mobile App APIs

APIs serving mobile apps often have higher rate limits (to handle spotty connections) and less protection (no browser to challenge).

3. Microservices Internal APIs

Service-to-service APIs often have no rate limiting at all. One compromised service can DDoS all the others.

4. GraphQL Endpoints

A single GraphQL query can trigger dozens of database operations. Attackers craft queries that are cheap to send but expensive to resolve.

5. Webhook Receivers

Endpoints that accept callbacks from third parties. Attackers can spoof webhook payloads at scale.

API-Specific Attack Patterns

query EvilQuery {
  user(id: 1) {
    friends {
      friends {
        friends {
          friends {
            posts {
              comments {
                author {
                  friends {
                    # ... infinite nesting
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

// Vulnerable regex pattern
const emailRegex = /^([a-zA-Z0-9]+)+@[a-zA-Z0-9]+\.[A-Za-z]+$/;

// Malicious input
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"

What We Measure in Practice

Across DDactic scans of Israeli enterprises and financial institutions, the API surface consistently shows the same gaps. From a sample of scans covering multiple organizations:

• Over 1,150 API endpoints mapped across a six-company scan cohort
• 153 GraphQL endpoints discovered - nearly all without depth or cost limits
• Over 400 login pages identified, most without observable rate limiting on the API origin (only the frontend form is protected)
• Rate limiting detected on fewer than 2% of API assets
• 102 HTTP/2 services, the majority with no gRPC-aware WAF in front

The pattern is consistent: the main domain is behind a CDN. The API subdomain, the mobile backend, and the internal service mesh are on direct IPs with generic WAF rules that were written for web pages.

WAF Vendor Coverage: What the Lab Shows

We ran Patterns 1-6 through an API WAF inspection lab (May 2026) against three vendor configurations on our own intentionally-vulnerable demo server (AcmeScan v1.3.2, Node.js + ApolloServer, Hetzner CPX22). 20 concurrent workers, 10 seconds per run. The table below shows what each vendor's default free/entry-tier configuration actually does - and what requires a paid upgrade.

Why Traditional DDoS Protection Fails

CDN Limitations

CDNs excel at caching static content. API responses are typically:

• Dynamic (user-specific data)
• Authenticated (can't cache)
• Small but expensive (JSON payloads)

Result: Every API request passes through to your origin.

WAF Blind Spots

WAFs look for malicious payloads. API DDoS attacks use:

• Legitimate request formats
• Valid authentication tokens
• Normal-looking parameters

Result: WAF sees "valid" requests and lets them through.

Bot Detection Challenges

Browser fingerprinting doesn't work when:

• Clients are mobile apps (no browser)
• Clients are other servers (webhooks)
• JavaScript challenges break the API contract

Result: Can't distinguish automated attacks from legitimate automation.

Protecting Your APIs

1. Rate Limiting Done Right

# Good: Multi-dimensional rate limiting
rate_limit:
  global: 10000/minute           # Total API capacity
  per_ip: 100/minute             # Per source IP
  per_user: 500/minute           # Per authenticated user
  per_endpoint:
    /api/search: 10/minute       # Expensive endpoint
    /api/login: 5/minute         # Auth endpoint
    /api/export: 1/hour          # Very expensive

2. Request Validation

• Input size limits: Cap request body size (e.g., 1MB max)
• Query complexity limits: For GraphQL, limit depth and breadth
• Pagination enforcement: Max page size, require pagination
• Timeout enforcement: Kill requests that take too long

# GraphQL complexity limiting
query_complexity_limit: 1000
max_depth: 5
max_aliases: 10
introspection: disabled_in_production

3. API Gateway Protection

Deploy an API gateway that provides:

• Authentication validation at the edge
• Rate limiting before requests hit backend
• Request transformation and validation
• Circuit breakers for backend protection
• Anomaly detection across all endpoints

4. Backend Resilience

• Database connection pooling: Limit max connections
• Query timeouts: Kill slow database queries
• Async processing: Queue expensive operations
• Graceful degradation: Return cached/partial data under load

# Example: Request timeout middleware
async function withTimeout(handler, timeoutMs = 5000) {
  return Promise.race([
    handler(),
    new Promise((_, reject) => 
      setTimeout(() => reject(new Error('Request timeout')), timeoutMs)
    )
  ]);
}

5. Monitoring and Alerting

You can't protect what you can't see. Monitor:

• Request rate per endpoint (not just total)
• Response time percentiles (P50, P95, P99)
• Error rates by type (4xx vs 5xx)
• Backend resource utilization
• Cost per request (for cloud functions)

API Security Checklist

Use this checklist to assess your API's DDoS resilience:

1. Authentication: All endpoints require authentication (except truly public ones)
2. Rate Limiting: Every endpoint has appropriate limits
3. Input Validation: Size limits, type checking, sanitization
4. Query Complexity: GraphQL depth/cost limits enforced
5. Pagination: All list endpoints paginated with max page size
6. Timeouts: Request and database query timeouts configured
7. Monitoring: Per-endpoint metrics with anomaly alerting
8. Circuit Breakers: Backend failures don't cascade
9. Documentation: Rate limits published in API docs
10. Testing: Regular load testing includes API endpoints

The Business Case for API Protection

APIs often generate more revenue than websites but receive less security investment. Consider:

• API downtime = mobile app outage = lost transactions
• Partner API disruption = breach of SLA = penalties
• Resource exhaustion = cloud bill spike = margin erosion
• Slow APIs = poor user experience = customer churn

"We spend more protecting our marketing site than the APIs that process $50M in daily transactions."
- Anonymous CTO at a Series B startup

What Changes With Paid WAF Plans

The lab results above used default free-tier configurations. Paid plans add capabilities - but with an important catch.

What actually changes at each tier (summary)

• Free to Pro/Business: You gain custom rule slots. You can now write "block more than 10 POSTs to /auth/login per IP per minute." Nothing is written for you.
• Business to Enterprise (Cloudflare): API Shield adds GraphQL depth limits and schema validation - these are the first managed rules that understand API structure. Still requires you to upload your OpenAPI/GraphQL schema.
• AWS WAF to BotControl Targeted: Adds behavioral bot detection (browser challenges, session tokens). Protects auth endpoints against scripted attacks even from browser-fingerprint-capable clients. Does not add API payload inspection.
• AFD Standard to Premium: Gains DefaultRuleSet 2.1 (web exploit signatures) and BotManagerRuleSet. No API-specific managed rules. Our gRPC lab confirmed Premium blocks application/grpc by content-type - a protocol-level gate, not payload inspection.