On this page
How to use these references
Start with the primary source for the question you are investigating. Use the versioned references where a guide names a specific edition, and verify product-specific capabilities against the relevant documentation. The examples and implementation workflows on ShieldAPI.com are editorial recommendations, not claims of affiliation, certification, or measured product performance.
References were checked for this site’s September 19, 2026 content review. Standards, documentation, and implementations can change; keep your own review evidence with the configuration and version you actually deploy.
OWASP API Security Top 10 — 2023
A risk vocabulary for API reviews, including object authorization, authentication, resource consumption, inventory, and external integrations.
Read the primary reference ↗OWASP REST Security Cheat Sheet
A primary reference for transport, endpoint access controls, token checks, input handling, and response considerations.
Read the primary reference ↗OWASP LLM Prompt Injection Prevention
Layered guidance on direct and indirect prompt injection, untrusted context, detection, and application boundaries.
Read the primary reference ↗OWASP AI Agent Security
Guidance covering tool scope, context and memory, human oversight, monitoring, and validation around agent workflows.
Read the primary reference ↗NIST AI Risk Management Framework
A framework for incorporating AI risk considerations into design, development, use, and evaluation.
Read the primary reference ↗IETF RFC 8725 — JWT Best Current Practices
A technical reference for JWT verification and token-confusion risks. Apply its guidance through a maintained implementation.
Read the primary reference ↗OpenAPI Specification 3.1.0
The versioned HTTP API description specification used as the reference foundation in the schema-validation playbook.
Read the primary reference ↗Cloudflare API Shield documentation
A concrete vendor example of API-specific protection capabilities. Consult it for that product’s current scope; it is not a universal definition of an API shield.
Read the primary reference ↗OWASP API4:2023 — Resource Consumption
A risk reference for the limits that extend beyond request counts, including execution, memory, operations, and provider spending.
Read the primary reference ↗OWASP Logging Cheat Sheet
Guidance on application-level security events, event attributes, sensitive information exclusions, and protection of log data.
Read the primary reference ↗