API security with FortiWeb — OpenAPI-aware WAF for 2026 APIs
Published 10 Jun 2026
· By
Pawan Sharma
· Network Security
· 14 min read
Every modern app is an API. AWS WAF and Azure WAF treat APIs as HTTP traffic — they block obvious payloads but have no concept of schema, no per-endpoint logic, no positive security model. Per Fortinet's own Data Sheet, FortiWeb uses ML-driven API Discovery to continuously evaluate application traffic, builds a positive-security model from the profiled inventory, and enforces against OpenAPI / Swagger / XML / JSON schemas — including CI/CD-pipeline integration for automatic policy refresh on each API update.
OpenAPI ✓
Schema-aware
OpenAPI 3.x, Swagger 2.x, XML, JSON. Validation against the declared contract.
ML
API Discovery
Auto-surface undocumented endpoints. Build positive policy without manual catalog work.
CI/CD
Continuous Learning
Policy auto-adjusts when the API changes — releases don't break the WAF.
ATO
Account Takeover
Credential stuffing, token replay, behavioural detection. Advanced+ plans.
Why cloud-native WAFs miss API-specific attacks
AWS WAF and Azure WAF do basic string-matching for OWASP Top 10 payloads. That catches SQL injection strings, XSS payloads, basic command injection. It doesn't catch any of the OWASP API Security Top 10:
BOLA / IDOR (API1)
Accessing other users' resources by changing an object ID. Needs per-user, per-endpoint authorization context — string matching is blind to it.
Broken Authentication (API2)
JWT manipulation, weak signing, token-validation bypass. Needs JWT-aware inspection.
Excessive Data Exposure (API3)
Endpoint returns more data than the client asked for. Response-side schema enforcement catches this; string matching can't see it.
Lack of Rate Limiting (API4)
Per-key, per-endpoint rate limits — not just per-IP. Cloud-native WAFs do per-IP at best.
BFLA (API5)
Function-level authorization bypass — calling an admin endpoint without admin privileges. Needs role-aware policy.
Mass Assignment (API6)
Client sends extra JSON fields that update privileged attributes. Positive-security rejects fields not in schema.
Security Misconfiguration (API7)
Missing security headers, verbose errors, default credentials. Catchable by config + response inspection.
Injection (API8)
SQLi, NoSQLi, OS-command injection — same as web but inside JSON / XML payloads. Cloud-native WAFs partly catch this; FortiWeb fully.
Improper Asset Mgmt (API9)
Forgotten test endpoints exposed in production. Discovery surfaces these from traffic.
Insufficient Logging (API10)
Per-endpoint logging, attack-attempt context, integration into FortiAnalyzer / FortiSOC.
FortiWeb's API security architecture
From the Data Sheet
ML discovery → profiled inventory → positive-security policy → CI/CD-integrated refresh
Fortinet describes it as: "FortiWeb API Discovery and Protection uses machine learning algorithms to automatically discover APIs by continuously evaluating application traffic. Discovery is an integral role for establishing a positive security model and FortiWeb protects your critical APIs based on your profiled API inventory."
The schema validation can be integrated into the CI/CD pipeline, "automatically generating an updated positive security model policy once the API is updated." This is the key advantage over schema-import-only WAFs — your policy doesn't lag behind your code.
The capability stack — by FortiWeb tier
| API Capability | Std | Adv | Ent | Notes |
|---|---|---|---|---|
| Schema enforcement (OpenAPI, JSON, XML) | ✓ | ✓ | ✓ | Positive security against declared schema |
| ML API Discovery | — | ✓ | ✓ | Auto-surface undocumented endpoints |
| API Gateway (FortiAppSec Cloud) | — | ✓ | ✓ | JWT validation, key mgmt, per-key rate |
| Account Takeover protection | — | ✓ | ✓ | Behavioural ATO + credential stuffing |
| Credential Stuffing Defense | — | ✓ | ✓ | Pattern + reputation + ML |
| Behavioral Intent Analysis (ML) | — | — | ✓ | FortiAppSec Cloud Enterprise only |
| Advanced Bot Protection | — | — | ✓ | ML/biometric/behavioural — appliance + VM Enterprise |
| GraphQL handling | ✓ | ✓ | ✓ | Schema validation, depth/complexity limits |
Where to deploy FortiWeb for APIs
Public-facing APIs
- FortiAppSec Cloud (SaaS) — CNAME the API hostname
- Advanced or Enterprise plan for API Gateway + Discovery
- Multi-region delivery built in
- Lowest friction; zero infra
Cloud-VPC APIs
- FortiWeb-VM BYOL on AWS / Azure
- Sits in front of API Gateway / app load balancer
- Same policy framework as appliance
- Best for AWS / Azure-native deployments
Internal DC APIs
- FortiWeb appliance — 1000F+ for low-latency inspection
- On-prem data residency for regulated workloads
- FortiManager integration for centralised policy
- Best for BFSI / regulated
Microservice APIs
- FortiWeb Container in Kubernetes
- Sidecar or ingress integration
- CI/CD-aligned policy refresh
- Best for cloud-native microservice estates
A 6-week rollout plan
Week 1 — Schema import + initial policy
Import your OpenAPI / Swagger files. Initial positive-security policy in monitor-only mode.
Week 2 — ML Discovery + delta surface
FortiWeb runs Discovery against production traffic. Output: endpoints in the real traffic that weren't in your declared schema. Triage the delta — accept legit ones, reject zombies.
Week 3 — Policy tuning
Adjust schema, field types, required fields based on real-traffic feedback. Reduce false-positive rate to operational floor.
Week 4 — First endpoint to deny-by-default
Pick the lowest-risk endpoint; flip from monitor to enforce. Watch for 24 hours. Roll back if needed.
Week 5 — Cohort cutover
Flip remaining mature endpoints to enforce in waves. New/changing endpoints stay in monitor until stable.
Week 6 — CI/CD pipeline hook
Wire FortiWeb policy refresh into your release pipeline so future API changes auto-update the policy. Continuous Learning takes over.
FAQ
Does FortiWeb support OpenAPI 3?
What's the difference between API Discovery and API Gateway in FortiAppSec Cloud?
How does FortiWeb handle GraphQL?
Can FortiWeb sit in front of AWS API Gateway?
What's the positive-security model and why does it matter?
How long does API onboarding take?
Which deployment shape is best for API security?
What about token-replay attacks and credential stuffing?
Free API security audit
ML Discovery run against your APIs — find the undocumented endpoints first
Ogma runs a 7-day ML Discovery audit against your API traffic and returns the delta between your declared schema and the real-traffic catalog. Plus a tuned positive-security policy draft.
Request the API audit or explore the FortiWeb API Security landingSources
- FortiWeb Data Sheet — API Discovery and Protection, schema validation, CI/CD integration
- FortiWeb Ordering Guide (FWEB-OG-R25-20260318) — FortiAppSec Cloud API Gateway / Discovery tier mapping
- owasp.org/API-Security/ — OWASP API Security Top 10 reference
Related: FortiWeb deployment models · FortiWeb API Security landing · FortiAppSec Cloud
Stay ahead of cyber threats
One short email a week — curated Indian cybersecurity news, Fortinet releases, DPDPA updates. No fluff.
