API Security

  1. Authorization and Access Control
    1. Authorization Concepts
      1. Authorization vs Authentication
        1. Permission Models
          1. Access Decision Points
            1. Policy Enforcement Points
            2. Role-Based Access Control
              1. Role Definition and Management
                1. Permission Assignment
                  1. Role Hierarchies
                    1. User-Role Mapping
                      1. Dynamic Role Assignment
                      2. Attribute-Based Access Control
                        1. Attribute Categories
                          1. Subject Attributes
                            1. Resource Attributes
                              1. Environment Attributes
                                1. Action Attributes
                                2. Policy Definition Language
                                  1. Dynamic Access Decisions
                                    1. Context-Aware Authorization
                                    2. Authorization Implementation
                                      1. Object Level Authorization
                                        1. Resource Ownership Validation
                                          1. Hierarchical Access Control
                                            1. Cross-Tenant Isolation
                                            2. Function Level Authorization
                                              1. Operation-Specific Controls
                                                1. Method-Level Security
                                                  1. Administrative Function Protection
                                                  2. Property Level Authorization
                                                    1. Field-Level Access Control
                                                      1. Data Filtering
                                                        1. Conditional Field Access
                                                      2. OAuth 2.0 Scopes
                                                        1. Scope Definition and Management
                                                          1. Granular Permission Control
                                                            1. Scope Validation
                                                              1. Dynamic Scope Assignment
                                                              2. Policy Engines
                                                                1. Centralized Policy Management
                                                                  1. Policy Decision Points
                                                                    1. Policy Information Points
                                                                      1. External Authorization Services

                                                                    Previous

                                                                    4. Authentication Mechanisms

                                                                    Go to top

                                                                    Next

                                                                    6. Data Protection and Encryption