STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API Gateway must audit request and response details (such as method, URL, headers, body, status, etc.).

DISA Rule

SV-274533r1143563_rule

Vulnerability Number

V-274533

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001790

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Build or configure the API Gateway to log the necessary request and response details such as method, URL, headers, body, status, etc.

Check Contents

If an API Gateway is not in use, this is Not Applicable.

Verify the API audits execution time and performance metrics.

1. Inspect the API Gateway's logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes.

2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome.

3. Verify the API Gateway is configured to log the necessary request and response details, such as the type of request, request parameters, and response status.

4. Review the API Gateway's documentation to ensure proper auditing of request and response details is enabled.

If the API Gateway is not auditing request and response detail, this is a finding.

Vulnerability Number

V-274533

Documentable

False

Rule Version

SRG-APP-000095-API-001790

Severity Override Guidance

If an API Gateway is not in use, this is Not Applicable.

Verify the API audits execution time and performance metrics.

1. Inspect the API Gateway's logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes.

2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome.

3. Verify the API Gateway is configured to log the necessary request and response details, such as the type of request, request parameters, and response status.

4. Review the API Gateway's documentation to ensure proper auditing of request and response details is enabled.

If the API Gateway is not auditing request and response detail, this is a finding.

Check Content Reference

M

Target Key

5703