Akamai App & API Protector key terms

A reverse-proxy security control that inspects HTTP and HTTPS requests and blocks those matching attack signatures or policy violations before they reach the origin application.

The versioned policy container in App & API Protector that holds match targets, rules, hostnames, and settings, and that must be activated on a network before it takes effect.

A policy object that scopes which hostnames, paths, file extensions, or APIs a security configuration applies to, allowing different protection levels per application area.

The process of pushing a security configuration version to Akamai's staging or production network so edge servers begin enforcing it; changes stay dormant until activated.

A pre-production Akamai environment used to test a security configuration against real traffic or test hostnames before promoting it to production.

The live Akamai edge environment that serves end-user traffic; configurations activated here are enforced on real requests immediately.

A scoring engine that profiles normal request behavior per endpoint and flags requests whose attribute combinations deviate from the learned profile, catching attacks that signature rules miss.

A numeric value the adaptive engine assigns to a request or client based on observed anomalies; higher scores indicate greater likelihood of malicious intent and drive automated actions.

A named set of related attack signatures (for example command injection or SQL injection) that can be tuned together with a single action in the security configuration.

The specific portion of a request, such as a parameter value or header, that matched a signature rule; payload visibility helps analysts confirm and tune detections.

The enforcement decision assigned to a rule or attack group, typically alert, deny, or allow, which determines whether matching traffic is logged, blocked, or exempted.

A monitoring-only setting that logs matching requests without blocking them, commonly used during tuning or while validating a new rule before enforcement.

An enforcement setting that blocks matching requests, returning a configured error response to the client and preventing the request from reaching the origin.

The iterative process of reviewing alerts and false positives, then adjusting rule actions, exceptions, or thresholds so protection improves without breaking legitimate traffic.

A legitimate request incorrectly flagged or blocked by a security rule; reducing these without weakening coverage is a central tuning objective.

A targeted override that disables or modifies a rule's action for specific conditions, such as a URL path or parameter, instead of turning the rule off globally.

An administrator-defined condition, expressed with request attributes and match operators, that triggers a chosen action for traffic the built-in rule sets do not cover.

A control that counts requests matching defined criteria over a time window and applies an action when the count crosses a threshold, throttling abusive clients.

A risk rating derived from Akamai-collected data about an IP address's prior malicious behavior, used to preemptively challenge or block repeat offenders.

A policy that allows or denies requests based on the geographic location associated with the client IP address, often used to enforce regional access restrictions.

A specific URL and method combination through which a client interacts with an application programming interface; API protection scopes rules to these endpoints.

An approach that permits only explicitly defined and expected request structures, rejecting everything else, which is well suited to well-defined API traffic.

An approach that blocks requests matching known-bad signatures or patterns while allowing the rest, effective against familiar attack classes but blind to novel ones.

A machine-readable document describing an API's paths, methods, parameters, and schemas; security tooling can import it to learn valid request shapes for protection.

Checking incoming API requests against a declared structure so malformed, unexpected, or out-of-range parameters are rejected before reaching the backend service.

The process of distinguishing automated traffic from human users by analyzing request signatures, behavior, and client-side signals to classify clients.

A classification label, such as search engine, monitoring, scraping, or malicious, that groups detected bots so policies can treat each type differently.

A configuration that maps bot categories to actions like allow, monitor, challenge, or deny, controlling how automated clients are handled at the edge.

A response that requires a client to prove legitimacy, for example by solving a puzzle or running JavaScript, before the request is allowed through.

Collecting attributes such as headers, TLS characteristics, and browser signals to build a stable identifier for a client even when simpler identifiers change.

Evaluating patterns such as request timing, sequence, and navigation paths to infer whether a client acts like a human or an automated tool.

An attack that replays username and password pairs stolen elsewhere against login endpoints at scale, exploiting password reuse rather than guessing.

Unauthorized access to a user account achieved through stolen or guessed credentials; defenses include bot mitigation, rate limiting, and anomaly detection at login.

Automated collection of site content, prices, or data by bots; policies may allow some crawlers while throttling or blocking aggressive or unauthorized collectors.

A coordinated flood of traffic or requests from many sources intended to exhaust network, protocol, or application resources and make a service unavailable.

A denial-of-service attack that overwhelms bandwidth with massive traffic volume, typically measured in bits per second and mitigated by absorbing or filtering traffic.

A low-and-slow application-layer attack that opens many connections and sends request bodies extremely slowly, tying up server resources while evading volume-based detection.

A dedicated facility where attack traffic is diverted, inspected, and filtered so only clean traffic is forwarded toward the origin infrastructure.

The backend system that hosts the actual application content and logic; edge security services shield it from direct exposure to malicious traffic.

Practices that prevent attackers from discovering and targeting the origin server's real address directly, which would bypass edge security controls.