Agent WranglersAPS-42Recommended
Treat data from other APIs as untrusted
Check and limit what comes back from partner and third-party APIs, as you would for user input.
How to do it
Call partners only over HTTPS with certificate checks on. Validate each response against a schema, and cap its size and time. Never follow their redirects blindly, and never pass their data into queries, pages or shells unescaped. Then parse it once at the boundary into typed objects.
How to check
Point a staging integration at a test server that returns a huge body, a redirect to an internal address and a field holding <b>PENTEST</b>. The app refuses or escapes all three.
Sources
Related rules
- API-75 Wrap each outside API in one adapter in API design
- ARC-53 Parse input once at the boundary in Clean code and architecture
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/requests-files-and-caches/third-party-api-data">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.