API › Module 3 › Lesson 3
API Monitoring & Logging
Detect BOLA bursts, token abuse, and anomalies in API traffic
Opening
You cannot defend what you cannot see
API monitoring ties access logs, auth failures, latency, and anomaly alerts together. BOLA often shows up as many 200s on /resource/{id} with sequential IDs from one token.
1. What to log (safely)
Identity & route
user/sub, route template, method, status, latency — not raw secrets.
Auth outcomes
401/403 spikes, token revoke events, MFA challenges.
Abuse signals
429 rates, sudden fan-out across object IDs, odd User-Agents.
2. Alert ideas
Alert on: credential stuffing patterns, one token hitting thousands of distinct object IDs, admin route access from new geos, or GraphQL complexity spikes. Redact tokens/PII from logs; ship structured JSON to your SIEM.
Knowledge Check
A useful BOLA detection signal is:
Multiple choice