The API must be protected by a Web Application Firewall (WAF) or an API Gateway that monitors and filters incoming and outgoing traffic to prevent injection attacks, ensuring malicious inputs are detected and blocked.
Check
Verify the API is configured to use a WAF or API Gateway to manage traffic.
If the API is not configured to use a WAF or API Gateway in accordance with organization-defined security policies, this is a finding.
Fix
Build or configure the API to use a WAF or API Gateway to manage traffic.