API-mega-list

Least-privilege permissions

• Use separate API keys for each service — Never reuse the same login credentials across different APIs. If one service gets breached, attackers won't automatically access your other services.
• Grant only the minimum access needed — When setting up an API connection, restrict permissions to exactly what the AI agent requires (read-only instead of read-write, specific data types instead of everything). This limits damage if that API key is stolen.
• Rotate credentials regularly — Replace API keys every 30-90 days, and immediately after any team member leaves your organization.
• Store keys in a vault, not in code — Use a secure credential management system (like HashiCorp Vault, AWS Secrets Manager, or 1Password) rather than saving API keys in files or configuration where they're easy to find.

Network isolation

• Use a dedicated environment for API connections — Run the AI agent and API integrations on isolated servers or containers separate from your main business systems; this prevents a compromised API connection from accessing sensitive internal data.
• Implement a firewall allowlist — Configure network rules to only permit connections to the specific APIs your business actually uses; block everything else by default.
• Route through a proxy or gateway — Pass all API traffic through a central monitoring point that can inspect and filter requests before they leave your network.

Monitoring

• Log every API call and response — Track which APIs are being accessed, when, and what data is being sent/received; review these logs weekly for suspicious activity.
• Set up alerts for unusual patterns — Configure automated warnings if an API key is used from an unexpected location, makes unusually large data requests, or accesses APIs your business doesn't typically use.
• Audit the API list for changes — Periodically review which APIs are included in the list to catch if new, untrusted, or risky services have been added.

Red flags to watch for

• APIs with no recent updates — Avoid using APIs that haven't been maintained or updated by their creators in over a year; they likely won't receive security patches.
• Unexpected data in API responses — If an API returns strange content, unusual formatting, or instructions that sound like commands (especially anything asking the AI agent to ignore its normal rules), that's a sign of an attack and the request should be stopped immediately.
• Requests for overly broad permissions — Be suspicious if an API demands access to sensitive data categories your use case doesn't actually need, or asks for administrative-level permissions.
• Compliance mismatches — If your business operates in Europe (GDPR), healthcare (HIPAA), or finance (PCI), verify that each API meets these legal requirements before connecting; some external services don't comply and could put you at legal risk.