This page View Markdown Open in ChatGPT Open in Claude

Security features¶

Tokens and groups decide who can call which API, table and field. The features below add more layers on top of them.

APIs Security Report & Actions¶

Security › APIs Security Report & Actions scans the account and shows where a person could read or change rows that are not theirs: collections no pre-hook limits to the caller, groups that reach too far, weak auth providers and public APIs.
A leak comes with the request that proves it, and many findings come with an action that fixes them in one click, such as a row scoping pre-hook. Findings you accept are skipped with a reason.
The report gets a score out of 100 and is kept in git as src/api_security_report/, where an AI assistant working on the project can read it.
Learn more APIs Security Report & Actions.

Encrypted request payloads¶

Send the header x-am-encrypted-payload: true and put the encrypted payload in dataEncFE.
dataEncFE is { data, createdAt } encrypted with encryptionAlgorithmFETransfer and secretFETransfer of the secret. Share that key with your frontend or mobile app.
What it protects, and what it does not : anyone who opens your app or reads its JavaScript can find that key, so it is no secret from your users. The format is the one of CryptoJS (U2FsdGVkX1…), whose key derivation is based on MD5. Use it as an extra layer when TLS ends at a proxy or a CDN you do not control, never in place of HTTPS, tokens and groups.
A payload older than feTransferDataValidityInSeconds is refused, so a captured request can not be replayed later.
Turn on acceptOnlyEncryptedData and plain bodies and query strings are refused. It can be set for a database, a table, an API, and for custom and system APIs.

POST /api/schema/admin/mongodb/shop/orders/save-single-or-multiple
x-am-authorization: <API user token>
x-am-encrypted-payload: true

{ "dataEncFE": "U2FsdGVkX1+q3n..." }

common: <T.ISecretTypeCommon>{
    encryptionAlgorithmFETransfer: 'AES',
    secretFETransfer: '...',
    feTransferDataValidityInSeconds: 300, // older payloads are refused
},

Encrypted responses¶

Send the header x-am-get-encrypted-data to get the response encrypted in encryptedData, with the same transfer key.

Value	Response
`no_encryption`	`data` only
`get_only_encryption`	`encryptedData` only, `data` is null
`get_data_and_encryption`	`data` and `encryptedData`

Allowed origins¶

Add the web origins of your apps in Allowed Origins on the Sandbox Settings page.
When the list has entries, a browser request from any other origin is refused with 403 before anything runs.
An empty list allows every origin.

The root user can ask for a second factor when people sign in to the admin panel: a code from an authenticator app, a code sent by email, or both.
Recovery codes are shown once and stored hashed.
The root user also sets the code length and expiry, the attempts and the resend delay.
Email codes need the SMTP settings of the root user settings.

Vulnerabilities¶

Security → Vulnerabilities audits two scopes for known vulnerabilities : a summary by severity (critical, high, moderate…), then each package with its range, how it arrives (the chains from a package asked for by name), the version which clears it and whether that version was checked, and the details of every advisory.

Sandbox : the packages of your sandboxes, of every language your code is written in. A chip per language shows how many of its packages are vulnerable and narrows the list to them ; every package says its language, and its link opens the registry it comes from.

Language	Registry	What is audited	Advisories
TypeScript / JavaScript	npm	The packages of Sandbox settings, resolved from the registry as an install would resolve them today, with everything they bring	npm
Python	PyPI	What the image of its sandboxes has installed : the packages of Sandbox settings, what they brought, and the tools of the image	OSV
PHP	Packagist	The same, from `composer.lock` of the image	OSV
C#	NuGet	The same, from what NuGet restored in the image	OSV
Go	Go modules	The same, from the modules of the build of the image	OSV
Rust	crates.io	The same, from `Cargo.lock` of the image (with the crates of the runner of API Maker)	OSV (RustSec)
Java, Kotlin	Maven Central	The same, from the tree Maven resolved in the image : the packages asked for and what each brought	OSV

The image says what runs. For Python, PHP, C#, Go, Rust, Java and Kotlin the audit reads the packages in the image of the sandboxes : the version which is installed, not the one written in the settings (time 0.1.43 of Rust installs the newest 0.1.x), and the packages a package brought with it (requests brings idna and urllib3).
Before the image is built (the language was never run on this server, or its build failed) only the packages named in the settings are audited, at the version named or the newest one, and the page says so. Composer refuses to install a version with known advisories : such an image is not built, and the audit still shows what is wrong with the package.
What to do is said per package : set it to version x for a package you added (in Sandbox settings), rebuild the image for a package another one brought, a newer version of the runtime or an API Maker update for what came with the image. Compare versions shows what each newer version of a package asked for by name would bring ; for a package of another language than JavaScript it compares the advisories of each version itself.
API Maker : what the server is made of. API Maker v4 is built from crates of Rust : the crates compiled into it are audited against OSV (the RustSec database), and their fixed versions read from crates.io. They change with an update of API Maker : Deploy API Maker.
An audit is kept for an hour; an older one (up to 7 days) is shown at once while a new one runs, and Check now asks the registries again. Only package names and versions leave the server.

Encrypted and hashed fields¶

Schema conversions can store a field encrypted or as an HMAC SHA-256 hash, with the keys of your secret.

Good to know¶

API Maker itself speaks plain HTTP. Run it behind Caddy or another proxy that serves HTTPS: the installer sets up Caddy.
Encrypted payloads do not replace HTTPS. They add a layer on top of it, useful when TLS ends before API Maker.