Cloudentity announces GraphQL support (Image Credit: Ilya Pavlov on Unsplash)Cloudentity has added new features to secure GraphQL application programming interfaces (APIs). It claims that the new capabilities will accelerate deployment and allow developers to release APIs more securely. The new features enable: “centralized policy management and distributed protection against data leakage, API cyberattacks, and broken object vulnerabilities at the edge.”

Nathanael Coffing, CSO and co-founder of Cloudentity (Image Credit: LinkedIn)
Nathanael Coffing, CSO and co-founder of Cloudentity

Nathanael Coffing, CSO and co-founder of Cloudentity, said, “With the increase in development teams using GraphQL to accelerate time-to-market for applications, it’s absolutely critical that each API follows Zero Trust principles from authentication to authorization to mitigate the risk of vulnerable, leaky APIs.

“Our mission is to enable organizations to easily protect every API and data request. Our GraphQL support demonstrates Cloudentity’s commitment to providing leading-edge API authorization and access control solutions that meet the evolving needs of enterprises today.”

Why is Cloudentity targeting APIs?

GraphQL is a query language for APIs. It helps developers create a complete list of all the data in the API and stores them in a schema as objects. Developers can then restrict who has access to those objects to control what data is accessed. One of the problems here is that developers store data authorisation in the GraphQL business logic. This increases the risk of data leakage.

It is this problem that Cloudentity is seeking to resolve. The first thing it does is move data authorisation out of the API. It delivers several benefits:

  • All data requests can be monitored
  • Additional authorisation controls can be added to protect the data being requested
  • Auditing of rules becomes easier supporting compliance controls
  • Data access controls can be integrated with other access control systems
  • All of this is delivered using Cloudentity’s SaaS platform. It supports automated and intelligent authorisation policies across an organization’s APIs and data.

Enterprise Times: What does this mean?

The rise of the API has been key to many businesses’ digital transformation. However, too many APIs were rushed out in the early days and suffer from poor controls and security. Despite developers becoming more security aware, they have often struggled to add flexible and auditable access controls to their APIs.

One solution has been embedding controls inside each API. But with hundreds, maybe thousands of APIs to maintain, organisations are finding that approach brings its own problems.

Cloudentity believes it has the answer with its SaaS platform. Adding additional capabilities to support GraphQL is a smart move. The question is, how quickly will organisations look to adopt this to clean up their leaky APIs?


Please enter your comment!
Please enter your name here