F5 Distributed Cloud API Security

Discover APIs and prevent data leakage

Automatically discover API endpoints that are connected to your applications, and allowlist and monitor for anomalous behavior.

Why API Security Matters

Modern applications are constantly evolving, with increased dependencies on APIs. These API endpoints increase an application’s attack surface area and introduce new risks and vulnerabilities that current security tools struggle to mitigate.

Watch the video ›


The volume of APIs is rapidly increasing, with new vulnerabilities emerging that risk exposing sensitive data. Security teams are struggling to manage and identify exponential numbers of endpoints and connections across their infrastructure.

Shadow APIs

Developers often deploy public APIs, bypassing internally mandated security processes and procedures. 

Moving too fast

Orgs with CI/CD pipelines deploy new code and APIs swiftly, perhaps overlooking security requirements. 

Excessive data exposure

Developers often unintentionally expose sensitive datasets that may be leaked accidentally. 

Broken object-level authorization

Permissions need to be set to prevent one user from accessing another user’s data. 

Why F5 Distributed Cloud API Security?

Faster onboarding

Rapid deployment via SaaS with simple API discovery leading to operational savings.

Best-in-class performance

Points of presence (PoPs) in API security deliver high speed, scale, and API protection.

Simplified management

Observe API security and networking metrics from a single, centralized user interface.

Platform Overview

Secure and discover your APIs with Distributed Cloud API Security

Distributed Cloud API Security provides discovery and deep insights from use of AI/ML. Block API attacks in real time and eliminate vulnerabilities at their source. The SaaS-based portal enables users to manage and go deep for threat analytics, forensics, and troubleshooting of modern applications.

API security diagram

Key Capabilities

Detect and block Open Web Application Security Project (OWASP) API Top 10 attacks in real time by using automatic detection at the development and production layer.

Positive Security Model

You can automatically create and enforce a positive security model from your own OpenAPI specifications.

Automatic API Discovery

Detect all APIs across your applications, including rogue and shadow APIs.

Lifecycle Security

Integrate security into the API lifecycle process via CI/CD tools or leading API management vendors.

ML-Based Traffic Monitoring

Continuous machine learning monitors all traffic, allowing API security to predict and block suspicious activity.

Globally Distributed Apps

Distributed infrastructure across clouds and edge sites provides a consistent experience.

Automated Policy Generation

Automatically generate policies based on App-to-App and API-to-API patterns.

Distributed Cloud API Security Use Cases

Hybrid Security Deployments

Protect existing workloads in one or more clouds or in on-premises environments.

Workload Management Using a Service Mesh

Mesh Kubernetes controller and multi-layer security in and across clusters.

API Endpoint Identification

Discover API endpoints with Swagger import and export capabilities.

Broad Platform and Cloud Provider Support

Distributed Cloud Services can be delivered to apps running on any platform, on any public/private cloud. Connect and secure apps running in VMs, containers, bare metal, or serverless.

Service Discovery and Service Mesh Integrations

Supports multiple service discovery protocols simultaneously. Consul, Kubernetes, and DNS work out of the box. Istio or Linkerd service mesh can integrate with a Distributed Cloud Services ingress/egress gateway.

Automation, Alerting, and SIEM Integration

F5’s native Terraform provider, vesctl CLI tool, and public APIs deliver to the automation needs of app teams. Support for tools like Opsgenie or Slack for alerting, and Splunk or Datadog for SIEM, simplify life for DevOps and SecOps teams.

Ways to Deploy

Distributed Cloud Services deliver application management, networking, and security services closer to workloads and can be deployed in public/private clouds, on-prem data centers, and edge sites with centralized management via a SaaS-based console.

Public cloud

Manage and protect application workloads hosted in AWS, Azure, and GCP.

F5 Global PoPs

Manage and protect application workloads from any of the points of presence (PoPs) on the F5 global network.


Manage and protect applications at the data center and edge sites.


Protecting Web Apps and APIs in Distributed Cloud


Protecting Your Web Apps and APIs Across Distributed Environments

Learn more ›

Distributed Cloud API Security


F5 Distributed Cloud WAAP - Introducing the Distributed Cloud API Security

Read the article ›

F5 Distributed Cloud API Security


F5 Distributed Cloud API Security

Watch the video ›

Next Steps

Contact us for a trial

Talk to an expert to schedule a demo and plan a trial.