Wallarm API Security discovers APIs and protects them in real time from OWASP API Top 10 attacks, abuse, and account takeover. It covers REST, GraphQL, gRPC, SOAP, and WebSocket APIs without an API specification, and can identify shadow, zombie, and rogue APIs while generating OpenAPI specifications from live traffic. Its protections block injection, BOLA, broken authentication, and zero-day exploits; behavior analysis detects credential stuffing, malicious bots, account takeover, and L7 DDoS. The product flags APIs carrying personal, payment, credential, or health data and maps that data to compliance scope. API Leak Management scans public sources for keys, tokens, and credentials tied to customer domains. It is available as managed Security Edge or self-hosted through Kubernetes, cloud VMs, and API gateway connectors. The Security Edge Free Tier is 0.00 USD per free for up to 500,000 requests/month and three users/company. After its quota is exceeded, console access and integrations are disabled. Paid core plans require contacting sales.
Who it is for
It suits teams that need API discovery and runtime protection across multiple API protocols, with managed or self-hosted deployment options. The free tier may fit smaller usage needs, subject to its request limit and exclusions.
What is good
- Covers REST, GraphQL, gRPC, SOAP, and WebSocket APIs.
- Finds shadow, zombie, and rogue APIs.
- Blocks attacks including injection and BOLA in real time.
- Offers managed and self-hosted deployment options.
- Free tier includes up to 500,000 requests/month.
What to know first
- Free tier excludes vulnerability assessment and API Abuse Prevention.
- Console access and integrations disable after the free quota.
- Paid core plans require contacting sales for pricing.
Verdict
Wallarm API Security combines API discovery, attack protection, abuse detection, and sensitive-data visibility across several protocols. The free tier has defined usage and feature limits, while paid core plan pricing is available by contacting sales.
Wallarm API Security plans and pricing
All plansCompared on web application firewall software
- Free plan
- Yes
- API discovery
- Yes
- Runtime protection
- Yes
- API posture management
- Yes
- Sensitive data detection
- Yes
- Specification governance
- Yes
- Deployment model
- hybrid
