The API alert that matters,
without
the other forty.
Connect your API in minutes and catch abuse, anomalies, credential stuffing, endpoint scanning and outages — before they page your on-call. One trustworthy alert per real problem, with the severity and the reason attached. Deterministic detection you can read. CLI-first.
No credit card. No sales call. Connect your first API in minutes.
- 6 detection engines abuse, anomalies and outages out of the box
- < 10 min setup drop-in SDK — no proxies or traffic mirroring
- Deterministic detection every alert traces to a rule you can read
- One alert per incident deduplicated and ranked — never a pager storm
Your tools collect everything . Your on-call needs conviction .
Logs, metrics and gateway dashboards tell you what happened — not which of forty alerts is the real attack or the real outage. Teams running APIs in production don’t need more telemetry. They need fewer signals they can trust.
- 01 Dozens of dashboards, one for every tool
- 02 Alerts that fire constantly and lose meaning
- 03 Manual correlation across logs, traces, metrics
- 04 Slow, stressful incidents — every time
- 01 A small set of trusted signals
- 02 Context-rich explanations, not raw numbers
- 03 Next-best-action suggestions for on-call
- 04 Confident, calm operations
From API calls to actionable insights.
Three moves: get the data in, make sense of it, ship a decision your team trusts.
Drop-in agents and SDKs sit beside your APIs. No rewrites, no proxies, no traffic mirroring infrastructure to maintain.
Errors, latency, deploys and traffic anomalies stitched together automatically. One incident view per real problem — not per signal.
Each alert ships with severity, blast radius and the rule that fired — deduplicated so one real problem is one alert. No black-box AI: every detection traces to logic you can read.
Quietly opinionated. Loudly useful.
Built for engineering teams who want signal, not noise. Four design principles, hard-coded.
Correlation and de-duplication remove pager-spam so your team stays focused on what actually matters. One real problem = one alert.
SDK-first, CLI-native, API-complete. No enterprise gating, no demo-call paywall, no half-disabled free tier you have to escape. Starts free, stays honest.
Issues are ranked by user impact, blast radius, and revenue tier — not just how loud they are. Latency on /checkout outranks a 500 on /docs.
Thresholds, baselines and pattern detection — not a chatbot bolted onto a dashboard. Every alert traces to a rule with a number you can tune. Deliberate about value, skeptical of hype.
Six detectors. Every one a number you can tune.
No model you can’t inspect. Each detector runs on your live API traffic with a threshold in plain config — raise it, lower it, or turn it off.
Request volume on a route jumps against its own rolling baseline. Fires at 3× and climbs in severity from there.
A single IP piling up 401s and 403s — credential stuffing and password spraying before they succeed.
One IP touching many distinct routes in a short window — the signature of automated API mapping.
Traffic to a legacy, internal or never-before-seen endpoint that normally sees almost no calls.
A key’s volume spikes against its own baseline — a compromised key, runaway integration or retry loop.
The SDK goes silent. A crashed process or broken deploy can blind you with no error at all — silence becomes a Critical alert.
Every alert is deduplicated and rate-limited per actor, so one real problem stays one alert — never a pager storm.
203.0.113.44≥ 20 failures / 10 min per IP203.0.113.44 at the edge. Confirm no successful logins followed.
The dashboard your on-call
actually wants.
Real product. Real alerts. MITRE ATT&CK mapping — not a mockup.
OVERVIEW · KPIs · Requests over time · Status codes · Top endpoints by volume and error rate
ALERTS · Severity-ranked · Filterable by attack type · One row per real incident
ALERT DETAIL · Severity timeline · MITRE ATT&CK · Suggested response · What happened and why it matters
Up and running
in minutes.
Drop the SDK into your ASP.NET Core app. Four lines of config, then redeploy. First alert arrives as soon as traffic flows.
# Install the package
dotnet add package APIGuard.Sdkbuilder.Services.AddApiGuard(opts =>
{
opts.CollectorUrl = "https://apiguard-collector.navonstack.com/";
opts.ApiKey = "<your-api-key>";
opts.ProjectId = "<your-project-id>";
});
// Place before routing in the middleware pipeline
app.UseApiGuard();Full install guide (including invite token setup) available after sign-up. Start free →
A different layerof protection.
WAFs and API gateways block known signatures at the perimeter. APIGuard watches behaviour inside your traffic — and catches the attacks that slip through.
| Feature | WAF / API Gateway | APIGuard |
|---|---|---|
| Primary purpose | Block known attack signatures at the perimeter | Detect behavioral abuse, anomalies & outages |
| Alert model | Per-rule, high volume — fires on every match | Correlated — one alert per real incident |
| Explainability | Rule ID matched | Reason, blast radius, suggested response + MITRE ATT&CK |
| Detection logic | Static rules, manually tuned | Deterministic engines + rolling baselines, every threshold you can read and tune |
| Setup | Gateway-level change or traffic proxy | Drop-in SDK · under 10 minutes |
| Severity ranking | Not ranked by business impact | Impact-ranked by user blast radius |
| Credential stuffing | Detected only if it exceeds a static rule | Correlated across IPs, routes, and time windows |
Ready to protect
your APIs?
Deploy APIGuard in minutes and start detecting API abuse today. No credit card, no sales call.