What’s New in Release 1.0¶
API Security Local Edition 1.0 is the first General Availability release. It introduces the following capabilities.
API Discovery and traffic analysis¶
API Security ingests HTTP metadata from BIG-IP in real time and reconstructs API endpoints based on methods, paths, headers, and status codes. Endpoints are organized by host, providing per-application visibility across multiple domains.
Per-endpoint analytics, including request counts, authentication presence, and response code distribution
Smart path generalization that normalizes dynamic segments (for example,
/user/123is normalized to/user/$DYN$)Continuous ingestion with no manual refresh required
Host-based organization across multiple application domains
Shadow API and zombie API identification¶
API Security automatically identifies undocumented or unmanaged endpoints (shadow APIs) and endpoints that have not received traffic for an extended period (zombie APIs). Both are surfaced in the dashboard and contribute to the risk score for each endpoint.
Risk scoring¶
Each endpoint receives a dynamic risk score (0–100, mapped to High, Medium, or Low) based on multiple factors, including authentication status, shadow or zombie status, HTTP method risk, predictable path indicators, and the presence and location of sensitive data.
Schema management¶
API Security supports an end-to-end API governance lifecycle:
Import OpenAPI schemas to use as a baseline for comparison against observed traffic
Export traffic-derived schemas in JSON, PDF, HTML, or CSV
Apply batch operations to approve, reject, or block multiple endpoints
Enforcement through BIG-IP¶
API Security enables users to trigger blocking actions for shadow or unauthorized APIs from the user interface. Enforcement is performed by BIG-IP using its existing security stack. When a user selects Block in the API Security UI, the product calls the BIG-IP iControl REST API to update the relevant Web Application Firewall (WAF) policy.
Optional Advanced API Discovery with BIG-IP Advanced WAF¶
API Security Local Edition supports an optional enrichment layer that builds on top of the standard BIG-IP integration. Advanced API Discovery uses BIG-IP Advanced WAF / ASM inspection and High-Speed Logging (HSL) to collect additional API signals and enrich the discovered API inventory. For configuration details, see the Admin Guide.
Air-gapped deployment¶
API Security Local Edition is designed for fully self-hosted operation. No outbound internet connectivity is required. License activation is performed offline through a JSON Web Token (JWT) and Signed ACK exchange.
Deployment models¶
API Security Local Edition is provided as two installation packages:
Docker Compose package for single-host deployments, laboratory environments, and proof-of-concept usage
Kubernetes (Helm) package for production, high-availability, and multi-node deployments
User interface¶
The user interface is aligned with the F5 Design System. It provides a left-side navigation panel, refined layout and typography, and consistent visual styling across all views.
Role-based access control¶
The product supports three local user roles: Admin (full access), Maintainer (operational access without user or license management), and Viewer (read-only access). For details, see the Admin Guide.
Extended metrics time range¶
Metric views support visibility for up to one month, allowing teams to review API behavior trends over a longer period.