Yes. Internal APIs need the same basics as public ones: authentication, authorization, TLS, limits and an inventory. A network boundary is one control, and it fails when a laptop, a vendor or a compromised service gets inside. OWASP guidance explicitly covers internal APIs and microservices.
Myths and facts
| Myth | Fact |
|---|---|
| Nobody outside can reach it, so it is safe | Anyone or anything inside the network can, including compromised hosts and contractors |
| Internal traffic does not need TLS | OWASP API8 says to encrypt all API traffic, internal included |
| Services trust each other, so no auth between them | OWASP API2 says a microservice is vulnerable if other services can reach it without authentication |
| Nobody knows the endpoint exists | Discovery is easy from inside, and forgotten hosts are an OWASP API9 risk |
| It is only used by our own front end | Anything callable can be called directly, with other IDs and other roles |
| A gateway at the edge covers everything | Traffic that does not pass the gateway gets none of its controls |
What to apply
Authentication on every call, including service to service. Authorization on every object and function, as OWASP API1 and API5 describe. TLS between components, as API8 recommends. Rate and size limits, since an internal caller with a bug can overload a service as easily as an attacker.
What to test
- Call an internal endpoint without credentials from a test host.
- Call it with a token for a different service or a different tenant.
- Request objects that belong to other users.
- Call admin functions with a low privilege identity.
- Send oversized and malformed input.
- Check that old versions and test hosts have the same controls.
Prioritise by data and blast radius
You do not need to test everything at once. Start with internal APIs that touch customer data, payments, identity or deployment. Then work down.
Inventory first
You cannot test what you cannot list. Use the approach in finding undocumented API endpoints to build the list, and record environment, audience and version for each.
Try it yourself
Click through it at your own pace, or open it full screen. Notice that nothing in the scan depends on an API being public.
Quick check
Is mutual TLS required for internal APIs?
Not universally. Some form of strong service identity is advisable, and mutual TLS is one common way to provide it.
Should internal APIs be scanned in production?
Start in a test environment. Scan production only with agreed scope and safe settings.
Safeguard includes asset discovery and a free scan at gold.safeguard.sh/scan to start the inventory of what runs where.
Sources
- OWASP API2:2023 Broken Authentication
- OWASP API8:2023 Security Misconfiguration
- OWASP API9:2023 Improper Inventory Management
Last reviewed: 19 October 2026.
