An API gateway enforces only what it is configured to enforce on the routes it actually fronts, and both drift: new routes go live without authentication or rate limits, old versions keep serving traffic after their retirement date and client keys outlive the integrations that needed them. This health check is a recurring, measurable review of a live API gateway, whether deployed as a managed cloud service, a self-hosted gateway or an ingress layer in front of microservices. It turns the questions an API platform lead or auditor would ask into twelve metrics with formulas, thresholds and evidence, so each quarter can be compared with the last. It is written for API platform owners, application security leads, internal audit and the CISO's office.
This page measures; it does not explain how to configure the gateway. For authentication patterns, token validation and rate limit design, read the API Gateway Security Guide; for the gateway's own admin roles, keys and logs, use Securing the API gateway itself; return to them for every finding this review raises.
What this health check covers
The review covers every gateway instance and environment that serves production traffic, the routes and API versions it publishes, the clients and credentials registered on it, the policies attached to each route and the logs it produces. Backend services are in scope only where the check asks whether traffic reaches them through the gateway.
- Who runs it: the API platform owner collects the figures; the application security lead reviews them; API product owners accept findings for their routes; the CISO or delegate signs off red items.
- How it differs from the security guide: the guide sets targets such as zero unauthenticated routes. This check gives each target a formula, a data source and a threshold, adds coverage and lifecycle measures, and records the result each quarter.
- Standards basis: the metrics track the risks in the OWASP API Security Top 10 2023 that a gateway can see, notably API2 Broken Authentication, API4 Unrestricted Resource Consumption, API8 Security Misconfiguration and API9 Improper Inventory Management, and the runtime controls in NIST SP 800-228.
- Common search terms it answers: "API gateway audit checklist", "API security KPIs", "API inventory metrics" and "how to find deprecated API versions still in use".
Key takeaways
- Start with the inventory. Reconcile gateway routes with the API inventory before calculating anything else; unknown routes have no owner and no review.
- Measure what goes around the gateway. A gateway protects only the traffic that passes through it; compare edge traffic with gateway traffic every quarter.
- Policy coverage is per route. Authentication, schema validation and rate limiting each need a coverage figure across all non-public routes.
- Clients are non-human identities. API keys and client credentials need age, usage and ownership figures like any other machine credential.
- Thresholds are a starting point. The green, amber and red bands are NHI Mgmt Group recommendations; agree your own and keep them stable.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this API gateway health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| New route policy check | On every release (automated in the deployment pipeline) | API platform owner | Application security lead | Pipeline policy check results per route |
| Client and key review | Monthly | API platform owner | API product owners | Client and key export (metadata only), age, last use, owner |
| Full metrics review (this page) | Quarterly | API platform owner | CISO or delegate | Metrics table with figures, raw exports, findings log |
| Version retirement review | Quarterly | API product owners | Head of engineering | Deprecated versions, retirement dates, remaining traffic by client |
| Independent sample test | Annually | Internal audit or second line risk | Audit committee | Sample of routes re-tested for authentication, rate limits and logging |
| Event-driven review | After a gateway migration, major upgrade or API incident | Application security lead | CISO or delegate | Before and after figures for metrics 01 to 05 |
Fix one measurement date per quarter and take every figure as at that date. Gateway administrators should not be the only people signing off figures about the gateway's own coverage; this follows the separation of duties principle in NIST SP 800-53 Rev. 5 AC-5.
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. The formulas are recommended methods too: record the numerator, denominator and data source once and reuse them every quarter. "Route" means a published method and path (or operation) on a production gateway; "public route" means one on the documented list of endpoints approved to run without authentication.
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| API-01 | Route inventory reconciliation | Production gateway routes matched to an API inventory entry with a named owner ÷ all production gateway routes | Gateway configuration export, API inventory or catalogue | 98% or more | 90% to below 98% | Below 90% |
| API-02 | Gateway traffic coverage | External API requests that passed through the gateway ÷ external API requests seen at the edge load balancer, CDN or firewall for API hostnames | Gateway access logs compared with edge or load balancer logs | 99% or more | 95% to below 99% | Below 95% |
| API-03 | Authentication coverage | Non-public routes with an authentication policy attached and enforcing ÷ all non-public routes | Gateway configuration export (policies per route) | 100% | None (no amber band) | Below 100% |
| API-04 | Token validation completeness | Routes accepting tokens that check signature, issuer, audience and expiry ÷ routes accepting tokens | Gateway authentication policy configuration | 100% | 95% to below 100% with exception record | Below 95% |
| API-05 | Rate limit and quota coverage | Routes with a per-client rate limit or quota ÷ all routes (public and non-public) | Gateway policy configuration, usage plan export | 95% or more | 80% to below 95% | Below 80% |
| API-06 | Request schema validation enforced | Routes validating requests against the published specification in blocking mode ÷ routes with a published specification | Gateway validation policy configuration, API specification repository | 80% or more | 50% to below 80% | Below 50% |
| API-07 | Deprecated versions still serving | Count of API versions past their published retirement date that received any production request in the last 30 days; report requests and clients per version | Gateway access logs grouped by version, API inventory lifecycle field | 0 | 1 to 2 with an agreed client migration date | Any without a migration date |
| API-08 | Client credential age | Active API keys and client secrets older than the rotation period in your standard ÷ all active API keys and client secrets | Gateway or authorisation server client and key export (metadata only) | Below 5% | 5% to 20% | Above 20% |
| API-09 | Dormant clients | Registered clients or keys with no request in 90 days that are still enabled ÷ all enabled clients | Client export joined to gateway access logs by client identifier | Below 5% | 5% to 15% | Above 15% |
| API-10 | Encrypted backend connections | Routes whose gateway to backend connection uses TLS with certificate validation (or mutual TLS where required) ÷ all routes | Gateway upstream or backend configuration | 100% | 95% to below 100% inside one trust zone, with exception | Below 95% |
| API-11 | Request log completeness | Production requests logged with client identifier, route, status code and policy decision, and received in the SIEM within 15 minutes ÷ production requests | Gateway access logs, SIEM ingestion metrics | 99.5% or more | 98% to below 99.5% | Below 98%, or any gap over 24 hours |
| API-12 | Gateway software currency | Gateway nodes, plugins and policy extensions with no security update outstanding for more than 30 days ÷ all components (for managed services, count customer-managed plugins and self-hosted data plane nodes) | Gateway version inventory, security advisory feed | 100% | 95% to below 100% | Below 95%, or any component with a known exploited vulnerability |
Report the absolute count beside every percentage. A single red item on a route that handles personal or payment data makes the line red whatever the percentage says.
Self-protection figures for the gateway itself (number of administrators, signing key rotation, approval on configuration changes) sit in Securing the API gateway itself. Add them to this scorecard as a single line, "Gateway self-protection", rated by the worst of those figures, rather than repeating them here.
How to collect the data
Export raw rows rather than dashboard percentages, keep the exports with the findings log and record the query used, so the next quarter is calculated the same way.
- Freeze the date: agree the measurement date and export the gateway configuration from every production environment within one working day of it. If configuration is held as code, use the deployed commit, not the main branch.
- Reconcile the inventory first: match each route to the API inventory or catalogue and list unmatched routes and inventory entries with no live route. NIST SP 800-228 and OWASP API9 both treat inventory as the foundation; see OWASP API Top 10 API9 Improper Inventory Management Guide.
- Compare edge and gateway traffic: take a week of edge load balancer, CDN or firewall logs for API hostnames and compare request counts and paths with the gateway access logs. Paths that appear only at the edge reach a backend without the gateway.
- Read policies per route: from the configuration export, list for each route the authentication policy, token checks, rate limit or quota, schema validation mode and backend TLS setting. API-03 to API-06 and API-10 come from this one extract.
- Export clients and keys: client identifier, owner, created date, last rotated date and enabled flag; never export key values. Join to access logs to find clients with no requests in 90 days. See How to audit API gateway keys and usage plans.
- Group traffic by version: group 30 days of access logs by API version and client, and compare with retirement dates in the inventory for API-07.
- Check logging: sample 100 requests and confirm each log record carries client, route, status and decision; pull hourly ingestion figures from the SIEM.
- Sample the reds: for every red metric, test five to ten routes or clients directly in a non-production copy or with an authorised test client to confirm the figure is real.
Red flags that need action now
- Any non-public production route with no authentication policy, or with authentication in a log-only mode.
- Token validation that skips the audience or issuer check on any route accepting tokens from more than one issuer.
- Backend paths reachable from the internet without passing through the gateway.
- A deprecated API version still serving production traffic with no owner or migration date.
- Any route that returns personal data with no per-client rate limit, the pattern behind bulk scraping of records (OWASP API4 and API6).
- Enabled API keys whose owning team or partner has left, or keys older than one year on routes with write access.
- A gap of more than 24 hours in gateway logs reaching the SIEM, or access logs missing the client identifier.
- Unexpected configuration or policy changes on production routes outside a release. Treat them as a possible compromise and check the gateway's own controls in Securing the API gateway itself.
Findings log
Keep one running log across quarters so repeat findings are visible. Escalate a finding that stays red for two consecutive quarters to the CISO, and one that repeats three times to the risk register.
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-API-01 | [n] production routes not in the API inventory | API-01 | [Red / Amber] | [API platform owner] | [Date] | [Open / In progress / Closed] |
| HC-API-02 | [n] non-public routes without enforcing authentication | API-03 | [Severity] | [API product owner] | [Date] | [Status] |
| HC-API-03 | Version [v] past retirement serving [n] clients | API-07 | [Severity] | [API product owner] | [Date] | [Status] |
| HC-API-04 | [n] enabled clients with no requests in 90 days | API-09 | [Severity] | [API platform owner] | [Date] | [Status] |
| HC-API-05 | [Finding] | [Metric ID] | [Severity] | [Owner] | [Date] | [Status] |
Remediation map
| Finding type | Where to fix it |
|---|---|
| Unauthenticated routes, incomplete token validation | API Gateway Security Guide: authentication patterns and token validation settings |
| Missing rate limits and quotas | Rate Limiting and API Abuse Guide |
| Routes outside the inventory, deprecated versions still live | OWASP API Top 10 API9 Improper Inventory Management Guide |
| Traffic reaching backends around the gateway, unencrypted backend hops | API Gateway Security Guide: what a gateway should enforce; mTLS Guide |
| Old, dormant or ownerless API keys and clients | API Key Management Guide |
| Schema validation not enforced, misconfiguration | OWASP API Top 10 API8 Security Misconfiguration Guide |
| Gateway admin, signing keys and configuration integrity | Securing the API gateway itself |
| Incomplete logs | Secure Logging Vocabulary and Application Security Events Guide |
Related guides
- API Gateway Security Guide: the control design this check measures.
- Securing the API gateway itself: the gateway's own admin, keys and logs.
- API Security Maturity Model: the programme view across all APIs.
- API gateway migration playbook: when findings point to replatforming.
- Web application firewall (WAF) health check and Service mesh health check: companion checks for the layers either side of the gateway.
References
- OWASP: API Security Top 10 2023
- NIST: SP 800-228 Guidelines for API Protection for Cloud-Native Systems
- NIST: SP 800-204 Security Strategies for Microservices-based Application Systems
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (AC-5 Separation of Duties, CM-8 System Component Inventory, IA-5 Authenticator Management, SC-5 Denial-of-service Protection, SC-8 Transmission Confidentiality and Integrity)
- NIST: Cybersecurity Framework 2.0 (ID.AM-02, PR.AA-05, PR.PS-04)
- CIS: Critical Security Controls v8.1 (Control 2 Inventory and Control of Software Assets, Control 8 Audit Log Management, Control 16 Application Software Security)
Related NHI Mgmt Group resources: API Gateway Security Guide, API Security Guide, API Key Management Guide, Rate Limiting and API Abuse Guide.