ISO 27001
SOC 2 Type II
BSI C5
FinTech · mobile payment · WAAP, API Security
Pango migrates to AWS and upgrades security for web applications and APIs.
75–85%accuracy out of the box
API Security. Your API trusts every call. We check it.
Every endpoint gets its own policies, traceable to the call.
- Scripts reading customer records get banned
- New endpoints covered without touching the rest
- Account takeover fended off
Trusted byFrom mid-market to enterprise
API Security. What it is and what it does.
API Security is part of the Link11 WAAP platform. Every endpoint gets its own profile — content filter, ACL and rate limits per path — and API calls pass the same inspection chain as web requests, in one pass with the WAF and Bot Management.
Policies per endpoint, not per domain
OWASP API Top 10, fuzzing, account takeover
Enable and inspect GraphQL explicitly
Every endpoint is an entry point. Each one deserves its own protection.
84%Of security managers surveyed have already experienced an API security incident.
$58kAverage cost of an API incident.
27%Of respondents know which APIs transmit sensitive data.
- 24/7 SupportSecurity threats don’t wait for business hours, and neither do we. Our specialists are available around the clock to help you when needed.
- GDPR-compliantLink11’s European location ensures your content remains compliant with strict GDPR regulations and EU data protection laws.
- Fully managed serviceOur fully managed solution, maintained by security experts around the clock, ensures your protection is always up to date, 24/7, 365 days a year.
To an API, every call is a customer. Even the wrong one.
Three situations where web defenses look right past the API.
Built for browsersClassic web defenses check browsers and forms. An API has neither — abuse looks like normal use.
API requests pass through the same inspection chain as web requests, with their own profiles per path.
Every release changes the APINew endpoints, changed parameters — yesterday’s protection rule does not know them.
Policies attach to the path; a new endpoint gets its profile without touching the rest.
The risks are knownUnauthorized access, input fuzzing, vulnerability scans, account takeover — the OWASP API Top 10 are no secret.
Exactly these risks are covered by the inspection, in the same pass as WAF and Bot Management.
Every API gets attacked differently. So each one gets rules of its own.
Anyone can reach your API, including scripts that read out customer records ID by ID.
Every endpoint gets content filter, ACL and rate limits; sources that keep reading get banned.
FinTech provider Pango offers its products via the web and through mobile and native apps, a large number of attack surfaces.
Link11 ran in report-only mode first. Pango learned its traffic and fine-tuned Link11 to eliminate false positives and false negatives.
Case study: PangoScripts skip the app and try passwords and codes straight against its login API.
Rate limits per path and session cap the attempts; persistent sources get banned.
See what your API really receives. Down to the parameter.
Which endpoint was called, which profile applied and why the call got through or not.
Matched first, then inspected. Every call by its endpoint’s profile.
Legitimate trafficAttack, stoppedDelivered protected
Before you connect. The technical details.
- Onboarding: DNS change, reverse proxy
- Policies: Per path: content filter, ACL, rate limits
- Protocols: REST, GraphQL, mTLS
- Part of: WAAP platform, one interface
- GraphQL
- Blocked by default because GraphQL queries exceed the usual argument lengths. Explicitly enabled and inspected per profile.
- mTLS
- Mutual TLS authentication can be configured per application.
- Mobile SDK
- Apps sign every request; the platform verifies the signature.
- Path maps
- Paths are assigned to their profiles via regular expression; the longest matching expression wins.
- Profiles
- Per path a content filter profile, an ACL profile, its own rate limits — and edge functions where needed.
- WAAP API
- The platform is controllable through a documented API — policies, profiles and endpoints can be created from the pipeline.
- New paths
- A new endpoint falls under the matching entry of the security policy. It gets its own rules as soon as you add it.
- Direct traffic
- Only traffic that passes through the platform is protected.
Every time we’ve had a problem or question, we have enjoyed working with Link11.
Questions before you decide. Answered directly.
Isn’t our WAF enough?
For content, yes; for APIs, rarely. Many solutions rely on browser detection — which does not work for API traffic. API Security adds policies per endpoint, mTLS, rate limits per path and signatures for mobile apps, in the same pass as the WAF.
Does this work with GraphQL?
Yes, once enabled. GraphQL is blocked by default because its queries exceed the usual argument lengths and trigger a content filter rule. It is allowed and inspected deliberately in the endpoint’s content filter profile.
Does it protect user accounts too?
Yes. Credential stuffing, brute-force attempts and session takeovers are fended off — account takeover protection is part of API Security.
Can we control this from our pipeline?
Yes. The WAAP API is documented, and there is a guide for Terraform. Policies and profiles can be created during deployment instead of being patched in by hand afterwards.
What does API Security cost?
API Security is part of the WAAP platform. API Protection is an optional add-on and mTLS is part of Enterprise (see pricing); larger setups get an individual quote based on scope and operating model.
Let’s talk
Your business stays online. We’ll show you how.