OpenAPI Validation

The OpenAPI Validation module provides a rigorous framework for securing RESTful APIs by enforcing a "positive security" model based on your existing API documentation. OpenAPI (formerly known as Swagger) serves as a language-agnostic interface that defines exactly how your API should function. By integrating these definitions into the FortiADC, you can ensure that the WAF understands the intended capabilities of your service and blocks any traffic that deviates from those specifications.

This approach is highly effective because it does not rely solely on identifying known attacks. Instead, it proactively validates that every request adheres to your defined standards for paths, methods, and data structures.

The module is organized into two primary configuration tasks:

Configuring OpenAPI Detection

This task allows you to create specific rules that govern how the FortiADC handles API traffic. You can define the operational boundaries of your API and specify the actions the system should take, such as alerting or blocking, when a request fails to meet the validation criteria defined in your schema.

Importing OpenAPI Schema

This is the process of uploading your JSON or YAML specification files to the FortiADC. Once imported, the WAF uses this schema as a source of truth to verify that incoming requests use permitted HTTP methods, target valid endpoints, and include only the expected parameters. This effectively neutralizes "shadow" API calls and unauthorized attempts to probe your backend services for undocumented functionality.