API Security Standards

Bookmyairtravel LLC

Effective Date: 28/07/2025

1. Purpose

This document defines the security protocols and best practices required to protect Bookmyairtravel LLC's APIs against unauthorized access, misuse, data leaks, and other cybersecurity threats. These standards ensure safe integrations with third-party platforms (like GDS, payment gateways, and metasearch engines) and internal systems.

2. Scope

Applies to:

• - All public, private, and partner APIs
• - REST, SOAP, and GraphQL endpoints
• - Developers, DevOps, and third-party vendors accessing APIs
• - External APIs consumed by Bookmyairtravel LLC

3. Authentication & Authorization

OAuth 2.0 / OpenID Connect

- All APIs must implement OAuth 2.0 or OpenID Connect for secure user and client authentication.

API Keys

• - Each client or partner must be assigned a unique API key or token.
• - Keys must be rotated periodically (every 90 days) and logged securely.

Role-Based Access Control (RBAC)

• - Limit API access based on roles (admin, read-only, partner, etc.).
• - No hardcoded credentials in code or config files.

4. Transport Security

HTTPS Only

• - All API traffic must use TLS 1.2 or higher.
• - HTTP requests must be redirected to HTTPS automatically.

Certificate Pinning (Recommended)

• - For mobile applications or high-risk endpoints, enable SSL pinning to prevent MITM attacks.

5. Rate Limiting & Throttling

• - Enforce rate limits per client to avoid abuse or DoS attacks.
• - Implement burst control and backoff mechanisms for spiked usage.
• - Log all throttled requests for review.

6. Input Validation & Threat Protection

• - Sanitize all input parameters to prevent SQL injection, XSS, and path traversal attacks.
• - Use allowlists for accepted parameter values and types.
• - Reject unexpected HTTP methods (e.g., TRACE, PUT if unused).

7. API Gateway & WAF Integration

• - All APIs must be routed through an API Gateway (e.g., Kong, AWS API Gateway, Apigee).
• - Integrate with a Web Application Firewall (WAF) to filter known malicious traffic.

8. Monitoring, Logging & Auditing

• - Enable real-time logging of API requests, failures, latency, and authentication attempts.
• - Logs should include: timestamp, source IP, endpoint, request payload, and response code.
• - Use a SIEM solution to detect anomalies or brute-force patterns.

9. Token & Session Management

• - Use short-lived JWT tokens with signature validation.
• - Implement token revocation support for compromised tokens.
• - Secure cookies using HttpOnly, Secure, and SameSite attributes.

10. Versioning & Deprecation

• - Use URI-based versioning (e.g., /v1/, /v2/) to avoid breaking existing integrations.
• - Provide at least 90-day notice to clients before deprecating old API versions.

11. Third-Party API Security

• - Evaluate security documentation of third-party APIs before integration.
• - Use sandbox environments for testing.
• - Ensure contracts include data protection clauses and SLAs.

12. Incident Response

• - Define an API-specific breach protocol.
• - Notify affected clients within 24 hours of a confirmed data breach.
• - Patch vulnerabilities within 48–72 hours depending on severity.

13. Developer Guidelines & Training

• - Mandatory API security training for all backend and frontend developers.
• - Use automated static code analysis (SAST) and dynamic testing (DAST) tools during CI/CD.
• - Conduct annual penetration testing.

14. Review & Updates

• - API security standards are reviewed every 6 months or post major incident.
• - Any changes must be approved by the Security & Compliance Team.

Summary

Bookmyairtravel LLC is committed to maintaining secure APIs that protect user data, uphold platform integrity, and support seamless partner integrations. Adherence to these security standards is mandatory across all technical and business units.