---
header: API Enforcement
lang: en
last_updated: '2026-08-25'
url: https://docs.fastly.com/products/api-enforcement
---

Fastly's [API Enforcement](https://www.fastly.com/documentation/guides/security/api-security/api-enforcement/about-api-enforcement) validates incoming API requests against schemas you define and logs or blocks requests that don't conform. It runs at Fastly's Edge on traffic proxied through your services.

## How it works

By uploading one or more specification files with information about your API, you can define validation rules for individual operations in your API.

API Enforcement has two protection modes. Logging mode allows you to monitor API traffic and review how API Enforcement detects invalid requests without blocking any requests. Blocking mode blocks nonconforming requests at the edge.

When Fastly receives a request to your API, API Enforcement matches it against the corresponding operation in your schema and validates the HTTP method, domain, URL path, and query parameters. Conforming requests pass through to your origin. Nonconforming requests are logged or blocked based on your protection mode.

## Prerequisites

To purchase API Enforcement, you must have a [paid account](https://www.fastly.com/documentation/guides/account-info/billing/account-types#paid-accounts) with Fastly's Full-Site Delivery or Fastly's Streaming Delivery or have purchased one of our packaged offerings. Once purchased, API Enforcement can be enabled in the control panel by anyone assigned the role of superuser or engineer.

## Limitations and considerations

Keep in mind the following limitations and considerations:

- **Compute services.** This product is not available for use with Compute services.
- **Schema requirements.** This product can only validate traffic according to the schemas and fallback rules that you specify. False positives are possible if your schema does not match your actual API.
- **API request limitations.** This product only validates HTTP and HTTPS requests.
- **Security products note.** No security product, including those security services offered by Fastly, will detect or prevent all possible attacks or threats. As a subscriber, you should maintain appropriate security controls on all web applications and origins. The use of Fastly's security products does not relieve you of this obligation. As a subscriber, you should test and validate the effectiveness of Fastly's security services to the extent possible prior to deploying these services in production, continuously monitor their performance, and adjust these services as appropriate to address changes in your web applications, origin services, and configurations of the other aspects of your Fastly services.

## Billing

> **NOTE:** Billing limits for this product may be different depending on your [account type](https://www.fastly.com/documentation/guides/account-info/billing/account-types/), if you've purchased a [packaged offering](https://www.fastly.com/package-entitlements/), or are using a [product or feature trial](https://www.fastly.com/documentation/guides/account-info/billing/about-the-products-page).

Fastly charges for API Enforcement based on the volume of requests processed per month. These charges are separate from and do not include charges associated with other Fastly products, including Delivery, Compute and Next-Gen WAF services. When Fastly DDoS protection is enabled on a service, requests associated with mitigated attacks on that service are excluded from API Enforcement billing. Consider setting a \[spend alert]\(https://www.fastly.com/documentation/guides/account-info/billing/about-the-spend-alert-page/) for your account to automatically be notified when your month-to-date bill approaches or meets a specific dollar amount.

> **NOTE:** For more details about this product, including [pricing information](https://www.fastly.com/pricing) and help with purchasing it, contact your customer success manager or email [sales@fastly.com](mailto:sales@fastly.com).