# Security Features

> A security report of your account, encrypted payloads with a replay window, allowed origins, two-factor sign-in for the admin panel and npm package audits.

Source: https://docs.apimaker.dev/v1/docs/features/security-features.html

- Tokens and groups decide who can call which API, table and field. The features below add more layers on top of them.

## APIs Security Report & Actions

- **API Security › APIs Security Report & Actions** scans the account and shows where a person could read or change rows that are not theirs: collections no pre-hook limits to the caller, groups that reach too far, weak auth providers and public APIs.
- A leak comes with the request that proves it, and many findings come with an action that fixes them in one click, such as a row scoping pre-hook. Findings you accept are skipped with a reason.
- The report gets a score out of 100 and is kept in git as `src/API Security Report/`, where an AI assistant working on the project can read it.
- Learn more [APIs Security Report & Actions](https://docs.apimaker.dev/v1/docs/apis-security/api-security-report.html).

## Encrypted request payloads

- Send the header `x-am-encrypted-payload: true` and put the encrypted payload in `dataEncFE`.
- `dataEncFE` is `{ data, createdAt }` encrypted with `encryptionAlgorithmFETransfer` and `secretFETransfer` of the secret. Share that key with your frontend or mobile app.
- A payload older than `feTransferDataValidityInSeconds` is refused, so a captured request can not be replayed later.
- Turn on `acceptOnlyEncryptedData` and plain bodies and query strings are refused. It can be set for a database, a table, an API, and for custom, system and third party APIs.

```text
POST /api/schema/admin/bank/main/transfers/save-single-or-multiple
x-am-authorization: <API user token>
x-am-encrypted-payload: true

{ "dataEncFE": "U2FsdGVkX1+q3n..." }
```

```typescript
common: <T.ISecretTypeCommon>{
    encryptionAlgorithmFETransfer: 'AES',
    secretFETransfer: '...',
    feTransferDataValidityInSeconds: 300, // older payloads are refused
},
```

## Encrypted responses

- Send the header `x-am-get-encrypted-data` to get the response encrypted in `encryptedData`, with the same transfer key.

| Value | Response |
|---|---|
| `no_encryption` | `data` only |
| `get_only_encryption` | `encryptedData` only, `data` is null |
| `get_data_and_encryption` | `data` and `encryptedData` |

## Allowed origins

- Add the web origins of your apps in **Allowed Origins** on the Sandbox Settings page.
- When the list has entries, a browser request from any other origin is refused with 403 before anything runs.
- An empty list allows every origin.

## Two-factor sign-in

- The root user can ask for a second factor when people sign in to the admin panel: a code from an authenticator app, a code sent by email, or both.
- Recovery codes are shown once and stored hashed.
- The root user also sets the code length and expiry, the attempts and the resend delay.
- Email codes need the SMTP settings of the root user settings.

## Vulnerabilities

- `API Security → Vulnerabilities` audits the packages of API Maker and the npm packages of your sandboxes for known vulnerabilities : a summary by severity (critical, high, moderate…), then each package with its range, whether it is a direct, prod, peer or optional dependency, and the details of every advisory.

## Encrypted and hashed fields

- Schema conversions can store a field encrypted or as an HMAC SHA-256 hash, with the keys of your secret.

## Good to know

- API Maker itself speaks plain HTTP. Run it behind Caddy or another proxy that serves HTTPS: the installer sets up Caddy.
- Encrypted payloads do not replace HTTPS. They add a layer on top of it, useful when TLS ends before API Maker.