STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The amount of data returned by the API must be restricted.

DISA Rule

SV-274709r1143744_rule

Vulnerability Number

V-274709

Group Title

SRG-APP-000439

Rule Version

SRG-APP-000439-API-001005

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Ensure API responses are small and contain only the data necessary for the client's request.

To ensure that the amount of data returned by an API is appropriately restricted, implement and test measures like pagination, field filtering, query parameters, server-side limits, and proper access control.

Check Contents

Verify the amount of data returned by the API is restricted.

Check API endpoints:
Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories).

If the API exposes unusually large volumes of data in a single response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Vulnerability Number

V-274709

Documentable

False

Rule Version

SRG-APP-000439-API-001005

Severity Override Guidance

Verify the amount of data returned by the API is restricted.

Check API endpoints:
Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories).

If the API exposes unusually large volumes of data in a single response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Check Content Reference

M

Target Key

5703