# API security

* Authenticate and authorize protected endpoints; validate every request payload and identifier.
* Enforce object-level authorization on every read and write, using the authenticated principal and resource ownership at the operation that accesses the data.
* Bind only explicitly permitted request fields. Do not allow mass assignment of ownership, role, state, or other privileged properties.
* Bound request and response sizes, pagination, query results, and expensive operations.
* Apply rate limits and quotas to authentication, search, uploads, expensive operations, and other abuse-prone endpoints. Keep administrative routes separately protected.
* Define safe retry and idempotency behavior for state-changing requests. Protect against replay and duplicate side effects where relevant.
* Return only authorized fields. Do not expose stack traces, internal models, secrets, or implementation details in API responses or errors.
* Prefer explicit DTOs and schemas; reject unknown or ambiguous fields when accepting them could alter privileged state.
* Keep authorization, validation, serialization, and error responses consistent with the published schema and supported clients.
* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the user's requested scope.