---
description: Identify and address API vulnerabilities with discovery, schema validation, and abuse detection.
title: Cloudflare API Shield
image: https://developers.cloudflare.com/og-docs.png
---

[Skip to content](#main-content)

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/api-shield/llms.txt  
> Use this file to discover all available pages before exploring further.

# Cloudflare API Shield

Last updated Aug 24, 2026|Copy as Markdown|[View as Markdown](https://e8aee267.previews.developers.cloudflare.com/api-shield/index.md)|[Agent setup](https://e8aee267.previews.developers.cloudflare.com/agent-setup/)

Identify and address your API vulnerabilities.

Enterprise-only paid add-on

Note

Enterprise customers can preview this product as a [non-contract service](https://e8aee267.previews.developers.cloudflare.com/billing/understand/preview-services/), which provides full access, free of metered usage fees, limits, and certain other restrictions.

## Why care about API security?

APIs have become the [backbone of popular web services ↗](https://blog.postman.com/intro-to-apis-history-of-apis/), helping the Internet become more accessible and useful.

As APIs have become more prevalent, however, so have their problems:

* Many companies have [thousands of APIs](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/api-discovery/), including ones they do not even know about.
* To support a large base of users, many APIs are protected by a negative security model that makes them vulnerable to credential-stuffing attacks and automated scanning tools.
* With so many endpoints and users, it is difficult to recognize brute-force attacks against [specific endpoints](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/volumetric-abuse-detection/).
* Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon [usage patterns](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/sequence-analytics/).

Refer to the [Get started](https://e8aee267.previews.developers.cloudflare.com/api-shield/get-started/) guide to set up API Shield.

## Features

[Security features](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/)

Secure your APIs using API Shield's security features.

Use Security features

[Management, monitoring, and more](https://e8aee267.previews.developers.cloudflare.com/api-shield/management-and-monitoring/)

Monitor the health of your API endpoints.

Use Management, monitoring, and more

## Use Schema Profiles

[Application Profiles](https://e8aee267.previews.developers.cloudflare.com/waf/detections/application-profiles/) provides a shared detection, analytics, and mitigation model. Schema Profile is its only current profile type.

API Shield provides two Schema Profile sources. [Schema Learning](https://e8aee267.previews.developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/) learns from traffic, while [Schema Validation](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/schema-validation/) uses uploaded OpenAPI schemas.

Use API Shield for API inventory, OpenAPI governance, profile export, automation, and higher-scale API workflows. Use the WAF Application Profiles pages for Profile Analysis and Custom Rule enforcement.

## Availability

Cloudflare API Security products are available to Enterprise customers only. Anyone can set up [Mutual TLS](https://e8aee267.previews.developers.cloudflare.com/api-shield/security/mtls/) with a Cloudflare-managed certificate authority.

The full API Shield security suite is available as an Enterprise paid add-on. Refer to [API Shield plans](https://e8aee267.previews.developers.cloudflare.com/api-shield/plans/) for feature-specific availability.

Customers with API Security already have access to Schema Profiles through Schema Learning and Schema Validation. Cloudflare is opening a closed beta to invited Enterprise customers without API Security. Interested customers can contact their account team to express interest. Closed beta access does not imply future plan availability or pricing.

Note

API Shield currently does not work for JDCloud customers.

## Related products

[DDoS Protection](https://e8aee267.previews.developers.cloudflare.com/ddos-protection/)

Cloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised.

Was this helpful?

YesNo

## On this page

[![](https://e8aee267.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://e8aee267.previews.developers.cloudflare.com/)

```json
{"@context":"https://schema.org","@type":"WebPage","@id":"https://developers.cloudflare.com/api-shield/#page","headline":"Overview · Cloudflare API Shield docs","description":"Identify and address API vulnerabilities with discovery, schema validation, and abuse detection.","url":"https://developers.cloudflare.com/api-shield/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-24","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
```