API Abuse – Castle
API Abuse
Headless API protection
Castle supports protection of endpoints where client-side code can't be injected, such as desktop apps or REST APIs.
Real-time blocking
Rules execute in milliseconds to block API abuse inline without noticeable delay.
Custom definitions
Define API abuse your way using advanced filtering and real-time velocity queries.
Granular analytics
Leverage BI-grade analytics to expose API abuse and fraud rings at scale.
Data enrichment
Enriched with device intelligence, risk scores, velocity metrics, and much more.
Define API abuse using custom logic
Castle lets you use advanced filtering, real-time velocity queries, and custom lists to segment out API abuse with high precision.
deny
User Agent Age
is < 5 min
- and
Proxy IP
is true
- and
Count of events Get Access Keys
by ISP
in the last 15 min
is > 15
or
Signals
- include Blocked User Agents
Action on API abuse in real-time
Rules execute in milliseconds and can be used to adapt the user experience based on risk in real-time.
deny
Abuse Score
is > 90
- and
Disposable Email
is true
- and
Count events Registration
by Device Fingerprint
in the last day
is > 3
or
Signals
- include Blocked country
Add User ID Warned Account Sharers
Remove User ID Allowed Users
Send webhook
Send to Slack
#security-alerts
Real-time decisions
Assessments of data like user count per device or hourly failed logins executed in the blink of an eye.
Inline blocking
Initiate request blocks or step-up verifications anywhere in your app without disrupting the user experience.
Alerts & notifications
Ensure your team and users stay informed with triggered Slack notifications or webhooks.
A holistic view of API abuse
Harness the power of BI-grade analytics to expose API abuse attacks and unravel fraud rings with precision.
Event Data
| Timestamp | Policy | Event | User | Location | Connection | Device | Lists | Signals |
|---|---|---|---|---|---|---|---|---|
| Sat, Aug 8 07:59:08 | Challenge Medium Abuse Score | Challenge Requested | kevin.qfanjul@gmail.com | Spain, Gijón | Telefonica de Espana | Chrome on Windows 10 | Disposable email domains, New device | |
| Sat, Aug 8 07:59:08 | Deny Bad email | Registration Attempted | oleg.kalinovskiy75@gmail.com | Ukraine, Khmelnytskyi | Kyivstar | Chrome on Windows 10 | Trusted user devices | |
| Sat, Aug 8 07:59:08 | Deny [ScAuth] Attempted Login | Login Attempted | themba.ndlovu@gmail.com | South Africa, Cape Town | Starlink | Chrome on Windows 10 | Challenged IPs, Timezone Area Mismatch, Multiple Accounts Per Device | |
| Sat, Aug 8 07:59:08 | Deny Password Reset Policy | Password Reset | priya.sharma@gmail.com | India, Mumbai | Jio | Chrome on Windows 10 | Multiple Accounts Per Device | |
| Sat, Aug 8 07:59:08 | Challenge Trusted Device Policy | Challenge Succeeded | anton.volkov.2023@gmail.com | Russian Federation, Chita | Rostelecom | Chrome on Windows 10 | Disposable email domains, Multiple Accounts Per Device |
All the data you need to pinpoint API abuse
Every interaction is enriched with comprehensive device intelligence, risk scores, location data, and much more.
Risk Scores
Out of the box risk scores for account abuse, account takeover, and bot abuse.
Velocities
Compute personalized signals based on real-time metrics like counts, sums, averages, and more.
Device fingerprinting
Persistent device identifiers resilient to storage resets and resistant to privacy plug-ins.
Bot detection
Identify bot actions via bot scores, headless indicators, or velocity and rate limit checks.