The API alert that matters,
without
the other forty.
Connect your API and catch abuse, anomalies, credential stuffing, endpoint scanning and telemetry gaps. One trustworthy alert per real problem, with the severity and the reason attached. Deterministic detection you can read.
No credit card. No sales call. Free to start.
- 6 detection engines abuse, anomalies and telemetry gaps out of the box
- One NuGet package drop-in SDK — no proxies or traffic mirroring
- Deterministic detection every alert traces to a rule you can read
- One alert per incident deduplicated and risk-ranked, not a pager storm
Your tools collect everything . Your on-call needs conviction .
Logs, metrics and gateway dashboards tell you what happened — not which of forty alerts is the real attack or the real outage. Teams running APIs in production don’t need more telemetry. They need fewer signals they can trust.
- 01 Dozens of dashboards, one for every tool
- 02 Alerts that fire constantly and lose meaning
- 03 Manual correlation across logs, traces, metrics
- 04 Slow, stressful incidents — every time
- 01 A small set of trusted signals
- 02 Context-rich explanations, not raw numbers
- 03 Next-best-action suggestions for on-call
- 04 Confident, calm operations
From API calls to actionable insights.
Three moves: get the data in, make sense of it, ship a decision your team trusts.
A drop-in .NET SDK runs inside your API and sends request metadata — never bodies. No rewrites, no proxies, no traffic mirroring infrastructure to maintain.
Six detectors check your traffic against thresholds and rolling baselines. Related alerts from the same IP or API key are grouped into one attack story, and repeats are suppressed.
Each alert ships with severity, the rule that fired and the evidence behind it — deduplicated so one real problem is one alert. No black-box AI: every detection traces to logic you can read.
Quietly opinionated. Loudly useful.
Built for engineering teams who want signal, not noise. Four design principles, hard-coded.
Correlation and de-duplication remove pager-spam so your team stays focused on what actually matters. One real problem = one alert.
SDK-first, with a dashboard built for triage. No demo-call paywall: the free tier runs all six detectors, and Starter adds email delivery, full attack stories and investigation. Starts free, stays honest.
Severity comes from a 0–100 risk score built from seven signals — not just how loud the traffic is. An attack on /admin outranks the same volume on /docs.
Thresholds, baselines and pattern detection — not a chatbot bolted onto a dashboard. Every alert traces to a rule with a number you can tune. Deliberate about value, skeptical of hype.
Six detectors. Every one a number you can tune.
No model you can’t inspect. Each detector runs on your live API traffic with a threshold in plain config — raise it or lower it per project.
Request volume on a route jumps against its own rolling baseline. Fires at 3× and climbs in severity from there.
A single IP piling up 401s and 403s — credential stuffing and password spraying before they succeed.
One IP touching many distinct routes in a short window — the signature of automated API mapping.
Traffic to a legacy, internal or never-before-seen endpoint that normally sees almost no calls.
A key’s volume spikes against its own baseline — a compromised key, runaway integration or retry loop.
The SDK goes silent. A crashed process or broken deploy can blind you with no error at all — silence raises a “No data received from SDK” alert.
Repeats of the same alert type, actor and route are suppressed for a window set by severity, so one real problem stays one alert.
/auth/login in 10 minutes.20 failures / 10 min per IP203.0.113.44 at the WAF or API gateway. Then review account lockout policies and check the IP in threat intel.
The dashboard your on-call
actually wants.
Real product. Real alerts. MITRE ATT&CK mapping — not a mockup.
OVERVIEW · KPIs · Requests over time · Status codes · Top endpoints by volume and error rate
ALERTS · Severity-ranked · Filterable by attack type · One row per real incident
ALERT DETAIL · Severity timeline · MITRE ATT&CK · Suggested response · What happened and why it matters
Up and running
in four steps.
Drop the SDK into your ASP.NET Core app, register it in Program.cs, then redeploy. Your first event shows up in the dashboard within seconds.
# Install the package
dotnet add package APINine.Sdkbuilder.Services.AddApiNine(opts =>
{
opts.CollectorUrl = "https://apinine-collector.navonstack.com/";
opts.ApiKey = "<your-api-key>";
opts.ProjectId = "<your-project-id>";
});
// Place before routing in the middleware pipeline
app.UseApiNine();During the developer preview the SDK comes from a private package feed; you get feed access after sign-up. Start free →
A different layer of protection.
WAFs and API gateways block known signatures at the perimeter. APINine watches behavior inside your traffic — and flags the abuse a signature can’t see. It complements your WAF; it doesn’t block traffic.
| Feature | WAF / API Gateway | APINine |
|---|---|---|
| Primary purpose | Block known attack signatures at the perimeter | Detect behavioral abuse, anomalies & telemetry gaps |
| Alert model | Per-rule, high volume — fires on every match | Correlated — one alert per real incident |
| Explainability | Rule ID matched | Reason, evidence, suggested response + MITRE ATT&CK |
| Detection logic | Static rules, manually tuned | Deterministic engines + rolling baselines, every threshold you can read and tune |
| Setup | Gateway-level change or traffic proxy | Drop-in SDK · no proxy or gateway change |
| Severity ranking | Not ranked by business impact | Risk-scored from seven signals, such as admin routes being targeted |
| Credential stuffing | Detected only if it exceeds a static rule | Repeated failures per IP, grouped with that IP’s other activity into one attack story |
Ready to see what
your APIs are doing?
Connect APINine and start detecting API abuse today. No credit card, no sales call.