STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must audit exceptions and errors that occur during the processing.

DISA Rule

SV-274530r1143557_rule

Vulnerability Number

V-274530

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001775

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Build or configure the API to log exceptions and errors with sufficient detail for troubleshooting and analysis.

Check Contents

Verify the API audits exceptions and errors that occur during the processing.

1. Inspect the API's logs to ensure they capture exception and error events, including error codes, messages, and stack traces.

2. Simulate errors (e.g., invalid requests or server failures) and verify these are logged with relevant details like timestamps and error types.

3. Ensure the API is configured to log exceptions and errors with sufficient detail for troubleshooting and analysis.

4. Review the API's documentation support to ensure proper auditing of exceptions and errors is enabled.

If the API does not audit exceptions and errors, this is a finding.

Vulnerability Number

V-274530

Documentable

False

Rule Version

SRG-APP-000095-API-001775

Severity Override Guidance

Verify the API audits exceptions and errors that occur during the processing.

1. Inspect the API's logs to ensure they capture exception and error events, including error codes, messages, and stack traces.

2. Simulate errors (e.g., invalid requests or server failures) and verify these are logged with relevant details like timestamps and error types.

3. Ensure the API is configured to log exceptions and errors with sufficient detail for troubleshooting and analysis.

4. Review the API's documentation support to ensure proper auditing of exceptions and errors is enabled.

If the API does not audit exceptions and errors, this is a finding.

Check Content Reference

M

Target Key

5703