STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Clients must be configured to route requests through a single API gateway that enforces the association and transmission of organization-defined security attributes with each request.

DISA Rule

SV-274697r1143731_rule

Vulnerability Number

V-274697

Group Title

SRG-APP-000419

Rule Version

SRG-APP-000419-API-000945

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Clients must be configured to call a single API gateway URL rather than accessing backend services directly.

Check Contents

Note: The authorizing official (AO) may conduct a risk assessment if not using an API Gateway.

Check Client API Endpoints:
Examine the client-side code (whether a web app, mobile app, or another service) to confirm that all API calls are configured to point to a single gateway URL.

Review the access logs or traffic logs of the API gateway to determine where incoming requests are coming from. Verify all requests are originating from the expected single API gateway endpoint.

If the API is not configured to route requests through a single, authorized API Gateway endpoint, this is a finding.

Vulnerability Number

V-274697

Documentable

False

Rule Version

SRG-APP-000419-API-000945

Severity Override Guidance

Note: The authorizing official (AO) may conduct a risk assessment if not using an API Gateway.

Check Client API Endpoints:
Examine the client-side code (whether a web app, mobile app, or another service) to confirm that all API calls are configured to point to a single gateway URL.

Review the access logs or traffic logs of the API gateway to determine where incoming requests are coming from. Verify all requests are originating from the expected single API gateway endpoint.

If the API is not configured to route requests through a single, authorized API Gateway endpoint, this is a finding.

Check Content Reference

M

Target Key

5703