Dell's API Developer Portal centralizes API standards, facilitating software development with an emphasis on microservices and governance. It outlines REST API guidelines, emphasizes risks such as information disclosure, and offers security best practices to mitigate API vulnerabilities. Additional resources and access to Dell's APIs are available through the portal.

1. API Standards and Repository
API Standards and Repository: Dell’s central API repository on the API Developer Portal enables developing and managing new
software, with API-centered architectures and modular software design through micro services. The API Developer Portal helps drive
standardization among the company via governance and metrics.
What is a REST API?
• Representational State Transfer (REST) API’s are a software architectural
style that rely on stateless communications protocol (usually HTTP).
What are the guidelines for REST architecture?
• Create human-readable URIs where resource is exposed in terms of its
state but not methods.
• Client moves the application from one state to the next by following a
link that refers to identifiable things.
• Implement the default application protocol (HTTP) correctly using the
standard methods:
• GET - retrieve a representation of a resource identified by a URI.
• PUT - update this resource with this data or create it at this URI if it’s
not there already.
• DELETE – remove the resource.
• POST - create a new resource. Message body contains additional
data in form of parameterized values (such as JSON key-value pairs).
• Statelessness: a server contains no client state.
API Risks
• The most prominent risk is information disclosure.
• Common areas to attack include:
• Data in transit • Data at rest • Application logic
What are some examples of attacks on API’s?
• API Enumeration – mapping and recon of an API’s endpoints, methods, parameters,
etc.
• Fuzzing - testing a target system by repeatedly creating randomized input for a target
API with the aim of discovering an error.
• Injection - a broad class of attack vectors that allow an attacker to supply untrusted
input to a program.
• Cross-Site Scripting – injecting malicious code into the content of an otherwise trusted
application.
• Cross Site Request Forgery - forces the end user to execute unwanted actions on the
application in which they’re currently authenticated.
• Sensitive Information in URL – non-encrypted data or plain text URL’s.

2. • Transport Layer Security (TLS) - use TLS/HTTPS to encrypt the connection between two
mediums
• Access Control (Authentication and Authorization) - perform access control at every API
endpoint, with every request
• Restricted HTTP Methods - Restrict endpoints to respond only to the HTTP Methods that
are relevant to the type of request
• Validate Content Types – Disallow body data that does not match the declared content
type and reject requests containing unexpected or missing content type headers
• Send Safe Content Types - Ensure sending intended content type headers in the response
matching the body content
• API Endpoints Management - Where possible, do not expose management endpoints to
the Internet
• Proper Input Validation - All inputs to the application must be validated to the intended
length, range, format and type
• Error Handling - Generic error messages should be responded to avoid revealing
unnecessary details of the failure
• Logging & Monitoring - Logs should be written before and after the security related events
and consider logging token validation errors to detect attacks
API Standards and Repository
API Standards and Repository: Dell’s central API repository on the API Developer Portal enables developing and managing new
software, with API-centered architectures and modular software design through micro services. The API Developer Portal helps drive
standardization among the company via governance and metrics.
API Security Best Practices
Additional Resources
• Application Programming Interface
(API) Standard
• Technology Standards
• API Security Guidelines
• Dell Transport Layer Security (TLS)
– Guidelines
• Cryptograpy Standard
• Logging & Alerting Standard
• API Developer Portal
Documentation
• API Linting Process
• API Developer Portal - Instructional
Videos
• Contact: Api-portal@dell.com
Have additional questions?
API Marketplace
• Upload or subscribe to Dell’s APIs via the API Developer Portal.
• Filter by API type, access type, category, or organization.