Monitor API abuse

A single denied request may be noise. A pattern across accounts, objects, or regions may be an active attack. Monitoring is what turns individual log lines into that pattern.

Log the fields that make patterns visible

Log safe actor, credential, operation, target, result, cost, and correlation identifiers:

{
  "ts": "2026-08-03T09:14:02Z",
  "requestId": "req_7f3ab910",
  "actor": "usr_8817",
  "credential": "key_analytics_prod_covk",
  "op": "GET /invoices/:id",
  "target": "inv_00214",
  "result": 404,
  "dbMillis": 4
}

No tokens, no bodies with card numbers. The log itself must stay safe to read broadly, or access to it becomes the next incident.

Alert on deviations, not single events

One failed invoice lookup is normal. One token reading sequential invoice IDs across 40 accounts is a stronger object-access signal:

alert: object-enumeration
  when:  one credential produces > 30 distinct 404s
         on /invoices/:id within 5 minutes
  show:  actor, credential, sample targets, request IDs
  action: revoke-credential runbook (owner: platform-team)

Build alerts around meaningful deviations and high-impact actions: authorization failures clustering on one route, a refund spike, an admin permission granted at 3 AM, a configuration change nobody deployed.

Tune the signal with known traffic before paging anyone. Replay a week of production logs against a new rule. If it fires on your own nightly batch jobs, fix the rule now, because an on-call rotation learns to ignore a noisy alert within days.

Give responders a lever

Detection without containment is bad news delivered faster. Give responders a way to revoke credentials and limit operations quickly. The alert should show why the pattern is unusual and give the responder a reversible containment action with a named owner.

Reversible matters. Revoking one credential or lowering one rate limit can be undone in minutes if the alert was wrong. Blocking a whole IP range cannot, and false positives there hurt real customers.

Generate a normal access pattern and a cross-account enumeration pattern. Prove the second creates one actionable alert with actor, targets, request IDs, owner, and a tested revocation step.