API Endpoint Management and Metrics Reach General Availability

APIs now account for more than half of all traffic handled by Cloudflare, and that share is growing twice as fast as traditional web traffic. Yet managing those endpoints has historically meant focusing almost exclusively on security, leaving performance monitoring as an afterthought.

That changes today. Cloudflare is making endpoint management and performance metrics generally available to API Shield customers. The new capabilities let teams save, update, and track endpoints, then monitor key health indicators like latency, error rate, and response size all from the Cloudflare dashboard.

From Discovery to Management

API Discovery has long automated the process of cataloging endpoints exposed to the internet. That remains an essential first step, since undiscovered APIs are effectively invisible to security teams and therefore less likely to have proper policies applied.

But discovery alone was never sufficient. Customers asked for more control: the ability to manually add endpoints that aren't yet deployed, and the ability to ignore endpoints that are on their way out. With general availability, API Shield customers can now save endpoints found by Discovery or add their own. They can also delete endpoints they no longer want to track and export schemas for each host for sharing internally or externally.

Performance Metrics for Every Endpoint

Once endpoints are saved, Cloudflare begins collecting real-time performance data and surfacing it in the dashboard's Endpoint Management tab. For each endpoint, the collapsed view shows summary metrics including recommended rate limits, average latency, and error rate. Sparklines provide context by comparing current values against the endpoint's own historical performance.

Expanding an endpoint reveals deeper detail:

  • Request count: total requests over time.
  • Rate limiting recommendation: a suggested threshold per 10 minutes based on request volume.
  • Latency: average origin response time in milliseconds, measuring the full round trip from request to response.
  • Error rate: broken down by 4xx, 5xx, and their combined total relative to overall traffic.
  • Response size: average response size in bytes returned to the requester.

Charts can be viewed over a 24-hour or 7-day window. The expanded view also shows percentage differences between the current and previous periods, and anomaly detection flags endpoints with concerning performance shifts. Hovering over charts reveals metric values at specific timestamps.

Discovery and Schema Validation Updates

The general availability release also brings two enhancements elsewhere in API Shield.

First, API Discovery now accepts cookies as session identifiers, in addition to authorization headers. Previously, only HTTP headers could identify an API session, leaving cookie-authenticated endpoints unprotected. Teams can now edit session identifiers from the API Shield tab and either change the identifier type or add an additional one.

Second, Schema Validation can now validate request bodies for all customers. Using an uploaded OpenAPI schema as a template, Cloudflare blocks non-conformant requests at the edge. Previously validation was limited to headers, cookies, and other metadata; now every element of a request can be checked, including the payload itself. Customers with existing uploaded schemas must re-upload them to use body validation.

Availability

Endpoint management, performance metrics, schema exporting, cookie-based discovery, and schema body validation are all available now for API Shield customers. To get started, navigate to Security in the Cloudflare dashboard and choose API Shield. After enabling it, endpoint discovery begins immediately. The features are also accessible programmatically through Cloudflare's API.