Documentation

HTTP API Security

AegisGate provides comprehensive security enforcement for HTTP/REST API interactions with AI systems.

Threat Landscape

HTTP APIs are the most common interface for AI model access, exposing several attack vectors:

  • Prompt injection: Malicious instructions embedded in API requests
  • Data exfiltration: Sensitive data extraction through crafted prompts
  • Denial of service: Token exhaustion, context flooding, and resource abuse
  • Adversarial inputs: Carefully crafted inputs designed to bypass safety controls

AegisGate Enforcement

LayerProtectionDetection Rate
Request screeningPrompt injection, jailbreak detection100% (adversarial suite)
Response filteringPII redaction, content classification83.1% coverage
Rate limitingPer-IP, per-API-key, per-endpointConfigurable
Audit loggingFull request/response recordingATLAS-mapped

Configuration

http:
  screening:
    enabled: true
    prompt_injection: block
    jailbreak: block
  response:
    filter_pii: true
    redact_patterns: [ssn, credit_card, email, phone]
  rate_limit:
    requests_per_minute: 60
    burst: 100

For general security architecture, see Security Overview.