STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must audit rate-limiting events.

DISA Rule

SV-274525r1143929_rule

Vulnerability Number

V-274525

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001750

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Build or configure the API Gateway to enforce rate limits and log these events, including the thresholds for triggering rate limiting.

Check Contents

Verify the API audits rate-limiting events.

1. Access the API configuration to ensure rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 1,000 requests per hour).

2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions.
The API's audit or access log entries should:
- Indicate when a rate limit was exceeded.
- Include details about the API key or user who exceeded the limit.
- Provide the rate-limiting threshold (e.g., "rate limit exceeded: 1,000 requests per hour").
- Mention the specific API endpoint that was accessed.

3. Review the organization's security policies to ensure rate-limiting events are properly audited as per requirements.

If the API is not auditing rate limiting events, this is a finding.

Vulnerability Number

V-274525

Documentable

False

Rule Version

SRG-APP-000095-API-001750

Severity Override Guidance

Verify the API audits rate-limiting events.

1. Access the API configuration to ensure rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 1,000 requests per hour).

2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions.
The API's audit or access log entries should:
- Indicate when a rate limit was exceeded.
- Include details about the API key or user who exceeded the limit.
- Provide the rate-limiting threshold (e.g., "rate limit exceeded: 1,000 requests per hour").
- Mention the specific API endpoint that was accessed.

3. Review the organization's security policies to ensure rate-limiting events are properly audited as per requirements.

If the API is not auditing rate limiting events, this is a finding.

Check Content Reference

M

Target Key

5703