API Security: A Review of Vulnerabilities, Detec-tion Methods, and Emerging Defences

Application Programming Interfaces (APIs) enable communication between applications, services, and distributed systems. As web, mobile, cloud-native, and microservice architectures increasingly depend on APIs, their endpoints also provide opportunities for unauthorized access, data exposure, service disruption, and misuse of security mechanisms. This paper presents a review of four recent peer-reviewed sources on API security (a systematic review of security-API misuse detection, a systematic review of web API vulnerabilities and developer challenges, an overview of API protection across the software development life cycle, and a discussion of emerging technologies) and uses their combined findings to build a case for, and a design of, an integrated two-module security framework: a design-time control module aligned with the SDLC, and a runtime protection and monitoring module. The review covers recurring vulnerabilities (broken object-level authorization, weak authentication, excessive data exposure, injection, misconfiguration, inadequate rate limiting, poor asset management, and insufficient logging), the human and technical causes of insecure implementation, static, dynamic, heuristic, and machine-learning-based detection approaches, and emerging directions including AI/ML, zero trust, and adaptive authentication. The paper then details a proposed framework architecture, data and tooling requirements, an evaluation plan with specific metrics, expected outcomes, and a discussion of limitations and future work. The overall conclusion is that API security should be treated as a continuous lifecycle responsibility, and that emerging technologies should complement, not replace, fundamental controls.