API asset management consolidates the API assets of your sites on the Assets tab of API security, together with their invocation statistics, sensitive data types, and risk events. Use API asset management to locate a target API operation, review its details and protection suggestions, and export the asset list.
Considerations
The following data rules and limits apply to API asset management:
Default statistical period — The default statistical period of the statistics is 30 days.
Inactive asset cleanup — API operations that have not been accessed for more than 30 days are removed from the default asset list.
AI analysis scope — Analyzing objects connected in hybrid cloud mode is not supported.
View API asset data
You can view the API asset data details by using either of the following methods:
On the API Security page, click the Assets tab.
On the Overview tab, click More in the Statistics on Request Sensitive Data Types table, or click View More in the upper-right corner of the Statistics on Response Sensitive Data Types table.
The Assets tab of the API Security page shows the API asset management statistics and the conditional search information. The tab contains three feature modules: API asset overview, the left-side site panel, and the API asset list. The fields and the management actions of the API asset list are described in Manage API assets. The export entry point of the list is described in Export and download API asset data.
API asset overview
API asset overview shows the total number of API assets and the numbers of New Events Today, Active APIs, Deactivated APIs, Response-sensitive Sites, Response-sensitive APIs, Cross-border Data Transmission APIs, and Machine-requested APIs.
In API asset overview, click the number of New Events Today, Deactivated APIs, Response-sensitive Sites, or Response-sensitive APIs to view the detailed data of the corresponding part in API Asset List.
Left-side site panel
The left-side site panel displays your site names and the number of APIs contained in each site. Click a site in the panel to view the detailed data list of the corresponding site in API Asset List.
API asset list
API Asset List supports two search methods. Use simple search when you already know the address or the remarks of the target API operation. Use advanced search when you need to narrow the list by several API attributes at the same time.
Simple search
In the search box above the API asset list, click the 
icon, select API Operation or Remarks, and then enter the corresponding API operation address or remarks.
Advanced search
Click More to set the search conditions. After you complete the search condition settings, click Search to perform the query.
The following table describes the search conditions. Conditions that correspond to columns of the API asset list use the same definitions as those columns. For the definitions, see the field descriptions in API asset field reference.
Condition | Description |
Time | The last active time of API assets. By default, data within the last 30 days is displayed (the full 24 hours of 30 days starting from yesterday up to the time of the query). Shortcut queries are also supported, including the last 15 minutes, last 30 minutes, last 1 hour, last 24 hours, today, yesterday, and the last 7 days. The minimum granularity for custom time queries is 10 minutes. |
Request sensitive data type | Multiple selections are supported. |
Response sensitive data type | Multiple selections are supported. |
Service object | Multiple selections are supported. |
Business purpose | Multiple selections are supported. |
Request method | Multiple selections are supported. |
Active status | Single selection is supported. |
Follow status | Single selection is supported. |
Authentication | Single selection is supported. |
Interface sensitivity level | Multiple selections are supported. |
To change the data fields that the API asset list displays, click the icon in the upper-right corner of the list and select the fields.
Manage API assets
After you search for and locate the target API operation, you can manage your API assets by using the features in the list.
Configure recognition and lifecycle policies
API security uses built-in recognition logic for API statuses, business purposes, and authentication credentials. You can adjust the following determination rules based on your own business characteristics:
Lifecycle management — Modify the determination rules for the New and Deactivated status labels in Policy Configurations > Lifecycle Management. For details, see VI. Allowlist Configuration.
Business purpose — Customize the business purpose fields in Policy Configurations > Business Purpose. For details, see V. Business Purpose Configuration.
Authentication credentials — Customize the authentication credential rules in Policy Configurations > Authentication Credential Configurations. For details, see IV. Authentication Credentials Configuration.
Follow and annotate API operations
Star: Click the icon in the column to change the follow status of the API operation.
Remarks: Click the icon in the column, enter the remarks about the API operation based on your business requirements, and then click the icon.
API asset field reference
The following table describes the fields in the API asset list.
Field | Description |
API | This field displays the API name, API status, and request method. Different request methods of the same API are determined as multiple API operations and displayed in the list. API security has built-in recognition logic for statuses. |
AI Analysis | You can use the AI security assistant to analyze APIs and obtain information such as business purpose, invocation trends, and security suggestions. |
Domain/IP | The domain or IP address to which the API operation belongs. |
Invocations | The number of visits to the API operation in the last 30 days. |
Interface sensitivity level | Rated based on the type and volume of sensitive data contained in the response. It is divided into four levels: high sensitivity, medium sensitivity, low sensitivity, and non-sensitive. |
Request sensitive data type | The sensitive data type contained in the request. |
Response sensitive data type | The sensitive data type contained in the response. |
Machine requests | The number of requests initiated by machines. Through layer-4 and layer-7 traffic fingerprint analysis, the number of requests whose source IPs are identified as machines is counted. |
Cross-border requests | The number of requests whose source IPs are from outside the Chinese mainland. |
Business purpose | Used to identify the functional purpose of an API operation. It is determined by matching the path and parameter name features of the operation against the built-in and custom business purpose fields. |
Service object | The caller or user of the API operation. It is determined based on the naming features of the operation and the aggregation of access sources, and is divided into three categories: internal office, third-party cooperation, and public services. |
Authentication | The authentication field of the API operation. The system has built-in recognition logic for authentication credentials. |
Risk/IP event/account event | Click a number in the column to view the risk or event details in the API risk details list. |
First discovered time | The time when the API operation was first discovered. |
Last active time | The most recent access time of the API operation. |
Follow | The follow status of the API operation. |
Remarks | The remarks that you add for the API operation. |
For more information about sensitive data types, see What sensitive data can API security detect.
For more information about service object types, see How does API security distinguish the service objects of interfaces.
For more information about business purpose types, see How does API security classify API business purposes.
For more information about interface sensitivity levels, see How are the interface sensitivity levels of API security divided.
For more information about the Risks / IP Events / Account Events counts in the list, see Risks and events.
View API details
Click the link in the API column of API Asset List to enter the API details drawer page. To view the API asset details on the full page, click the 
icon in the upper-right corner of the drawer page that appears.
The API details page contains the detailed information of the API asset, as well as the Sample Request, Traffic Analytics, Risks and Events, and Protection Suggestions tabs.
Request samples
A request sample contains up to five randomly sampled API request samples. Click Split Display and Merge Display to switch between display formats for viewing.
Split display supports splitting the samples into Standard, Request Header, Response Header, Request Body, and Response Body for viewing and copying separately.
Merged display supports splitting the samples into Sample Request and Sample Response for viewing and copying separately, which is convenient for traffic replay.
Click Browser to perform a quick verification operation. Click Command Line to obtain the command content for manual access verification.
The Request Parameter Type and Response Parameter Type sections display the Parameter, Value Characteristics, and Parameter Position of the request parameters and response parameters of the current sample, which are obtained by the API security feature through traffic baseline identification and marking of the current sample.
Traffic analysis
Access trend — Traffic analysis shows the access trend of the API operation within 30 days, and counts the Total Calls, Bot Requests, and Cross-border Requests of the operation.
Top 20 Access Sources — Lists the top 20 access sources in the last 30 days from the dimensions of total traffic, machine traffic, and cross-border traffic.
Client Source Statistics — Counts the sources of access clients in the last 30 days from the four dimensions of Referer, device, geographic location, and account.
Risks and events
Risks and events show the risk events, IP security events, and account security events related to the API, and support quick navigation.
Protection suggestions
Protection suggestions are provided based on the API invocation baseline.
Export and download API asset data
Click the
icon in the upper-right corner of the API asset list. API security creates an export task for you.Click Export Record in the upper-right corner of the API Security page. Locate the file to download, and click Download in the Actions column.