Apigee as a Continuous API monitor

Continuous API monitoring keeps an API observable over time, while on demand scanning inspects a point in time. middleBrick is an on demand scanner that you trigger to get a risk score and prioritized findings in under a minute. It uses read-only methods and does not modify traffic or configurations. Apigee functions as an operational monitor that tracks metrics, logs, and traffic patterns, but it does not replace targeted security scans for vulnerabilities and misconfigurations.

middleBrick maps findings directly to three frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For these frameworks, the scanner identifies specific controls and provides evidence relevant to audit activities. For other regimes, middleBrick helps you prepare for and aligns with security controls described in HIPAA, GDPR, ISO 27001, NIST, CCPA, and similar standards. It is a scanning tool and not an auditor, so it cannot certify compliance or guarantee adherence to any regulation.

The scanner covers 12 categories aligned to OWASP API Top 10, including authentication bypass, JWT misconfigurations, BOLA and IDOR, privilege escalation, input validation, rate limiting, data exposure, encryption, SSRF, inventory issues, unsafe consumption, and LLM/AI security. It performs black-box scanning without code access or agents, supports OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, and cross-references spec definitions against runtime behavior. It does not perform active SQL injection or command injection, does not detect business logic vulnerabilities, and cannot identify blind SSRF or replace a human pentester for high-stakes audits.

With Starter tier and above, you can enable authenticated scanning using Bearer tokens, API keys, Basic auth, and cookies. Domain verification is required so that only the domain owner can scan with credentials, and only a restricted set of headers are forwarded. The scanner follows a strict read-only posture, with destructive payloads never sent and internal infrastructure blocked at multiple layers. Customer data is deletable on demand and is never used for model training.

The Web Dashboard provides scan management, score trends, and downloadable compliance PDFs. The CLI allows on demand scans with JSON or text output, and the GitHub Action can gate CI/CD when scores drop below a threshold. The MCP Server enables scanning from AI coding assistants. Continuous monitoring in Pro tier adds scheduled rescans, diff detection, email alerts, signed webhooks, and integration options. These capabilities support security practices aligned with defined frameworks without implying certification or guarantees.