---
title: "Treat data from other APIs as untrusted · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/third-party-api-data
updated: 2026-10-20
licence: "All rights reserved"
---

# Treat data from other APIs as untrusted

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)
- Rule: Check and limit what comes back from partner and third-party APIs, as you would for user input.
- How: Call partners only over HTTPS with certificate checks on. Validate each response against a schema, and cap its size and time. Never follow their redirects blindly, and never pass their data into queries, pages or shells unescaped.
- Check: Point a staging integration at a test server that returns a huge body, a redirect to an internal address and a field holding `<b>PENTEST</b>`. The app refuses or escapes all three.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/third-party-api-data`.

- Previous: [Check the origin of WebSocket connections](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/websocket-origin)
- Next: [Unpack archives safely](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/safe-archive-extraction)
- [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)