APIs now drive the majority of application traffic
As Internet-connected applications multiply — from wearables and mobile apps to industrial monitoring systems — the way traffic flows across the network is shifting. Data from Cloudflare's global network shows that APIs have become the dominant communication method. During the first week of December 2021, API calls made up 54% of all proxied requests, up from 52% in the equivalent period in February 2021. Over that stretch, API traffic grew 21%, outpacing Web traffic, which grew only 10%. Media traffic rose by nearly 15%, while binary traffic was the only category to shrink, dropping 6%.
This growth is driven by changes in how applications are architected, how businesses operate, and how machines and humans interact. The separation of frontend and backend through API-based designs — exemplified by Jamstack, microservices, and serverless architectures — has made APIs the default interface between components. Meanwhile, API-first business models are reshaping industries: financial services startups use standards such as PSD2 to offer modular services, and logistics platforms provide shipping, labeling, and returns capabilities as APIs that e-commerce sites can integrate directly. Even infrastructure management is becoming API-driven, with tools like Terraform replacing manual configuration workflows.
How traffic is classified
Analysis of the data is based on all traffic proxied by Cloudflare, with content labelled according to the Content-Type header in the response. Only responses with a 200 status were considered, apart from the security analysis, and bot-generated traffic was excluded from the dataset. Trends compare the first week of February 2021 with the first week of December 2021.
API traffic is identified by responses carrying application/json, application/xml, or text/xml. Web traffic includes text/html, application/x-javascript, application/javascript, text/css, and text/javascript. The remaining categories are Text (text/plain), Binary (application/octet-stream), Media (all image, video, and audio types), and Other, which captures responses with no clear or missing Content-Type — some of which may be API traffic that simply lacks a proper header.
Where the growth is concentrated
In terms of sheer volume, the general Internet and Software industry accounts for roughly 40% of all API traffic in 2021. Cryptocurrency follows at 7%, with Banking and Retail at 6% and 5% respectively. But the fastest-growing sectors tell a different story. Banking saw API traffic surge 70% year-on-year, Retail grew 51%, and Financial Services increased 50%.
These figures align with broader industry movement. Banking and financial services have seen an influx of challenger banks and aggregation platforms that rely heavily on APIs to offer account consolidation, streamlined transactions, and direct investment from mobile apps. The competitive pressure these new entrants generate is pushing established institutions to modernize their infrastructure and open up their own API ecosystems.
Anatomy of API Calls: Methods, Payloads and Clients
A RESTful API call is fundamentally an invocation of a function: it targets a resource address (the endpoint), specifies an action (the method), and may carry additional data in a payload and HTTP headers. Headers supply context like client origin, requesting software, and authentication credentials. The method expresses the desired operation — GET retrieves information while POST updates or creates it.
Understanding the composition of API traffic — the methods in use, the protocols encoding payloads, and the types of clients generating requests — points to the macro-level sources of vulnerabilities. That context helps in designing and deploying appropriate protections.
Method Mix
Nearly all API requests (98%) are either POST or GET. POST is the most common at 53.4% of requests, followed by GET at 44.4%. A relevant distinction for security tooling: GET tends to carry sensitive data in the HTTP request header, query string, and response body, while POST more often transports data in the request header and body. This matters when deploying tools like API Schema Validation (covering both requests and responses) or Data Loss Prevention/Sensitive Data Detection (focused on responses), both of which Cloudflare launched in March 2021.
Payload Encoding Breakdown
API payloads are encoded with different rules and languages, commonly called transport protocols. Between the two most prevalent, JSON is dominant by request count (~97%). XML accounts for a smaller share of requests but still carries the heaviest traffic: it is the more verbose protocol, producing the largest payloads, while JSON is more compact and results in smaller responses.
Since Cloudflare began supporting gRPC in September 2020, gRPC traffic has shown steady growth. Many customers are in the planning stages of either migrating from JSON to gRPC or building translation layers at the edge that convert external JSON calls to internal gRPC services.
Client Origins and Intent
The HTTP User-Agent header identifies what kind of client made a request. Grouping the values into "browser," "non-browser" and "unknown" (where the header was not set) gives a picture of API traffic sources:
- Browser (38%): Web applications built atop backend APIs generate AJAX calls to populate dynamic page fields. This paradigm has become standard for building dynamic, flexible web apps.
- Non-browser (56%): This group includes mobile apps and IoT devices, with a long tail of types spanning wearables, connected sports equipment, and gaming platforms.
- Unknown (6%): Well-behaved browsers and tools like
curlsend a User-Agent by default, so missing headers are often indicative of programmatic or automated tooling — some of which may be malicious.
Encryption Landscape
Encrypting the session is core to securing APIs against snooping and tampering. Clients use SSL/TLS to authenticate the server they are connecting with — for instance, verifying that it is truly their cryptocurrency vendor. Beyond the handshake, transport layer encryption protects all application protocol bytes, providing confidentiality and integrity.
Cloudflare launched TLS v1.3 in September 2016 and enabled it by default on some properties in May 2018. TLS v1.3 is now the most widely adopted protocol for API traffic, with 55.9% of requests using it. The vulnerable v1.0 and v1.1 versions, deprecated in March 2021, have virtually disappeared.
Transport security protocol | December 2021 |
|---|---|
TLS 1.3 | 55.9% |
TLS 1.2 | 32.7% |
QUIC | 8.4% |
None | 2.8% |
TLS 1.0 | 0.3% |
The fastest-growing protocol is QUIC. Cloudflare has concentrated on HTTP/3, the mapping of HTTP over IETF QUIC. Support for QUIC draft versions began in 2018, and when QUIC version 1 was published as RFC 9000 in May 2021, Cloudflare enabled it for everyone the next day. QUIC uses the TLS 1.3 handshake but has its own packet protection mechanism. HTTP/3's share of API traffic grew from under 3% in early February 2021 to more than 8% in December 2021, broadly tracking RFC 9000 publication and the stabilization and enablement of HTTP/3 in various client implementations.
Mutual TLS, common for mobile or IoT device authentication, accounts for 0.3% of total API traffic. Since the first version of mTLS was released in 2017, interest has grown across all plan tiers. Customers can now manage certificates one-click from the Cloudflare dashboard via API Shield, eliminating the complexity of running a private key infrastructure and managing root certificates themselves.
Unencrypted traffic remains an attack opportunity since it exposes plain communications. That share dropped from 4.6% of all API requests in early 2021 to 2.6% by December 2021.
The Security Picture: Blocking and Error Trends
Given the high request volume Cloudflare processes, blocked traffic patterns reveal common threat trends. Notably, an HTML request is twice as likely to be blocked as an API request. Successful response codes (200, 201, 301, 302) account for 91% of HTML traffic and 97% of API traffic. 4XX error codes are generated for 2.8% of API calls, versus 7% for HTML. 5XX codes are almost nonexistent for APIs (under 0.2%) but represent almost 2% of HTML requests.
The higher proportion of unmitigated API requests reflects API automation: rendering a single page may generate many API calls, diluting the share of malicious or malformed requests among a larger volume of legitimate automated traffic.
Error Code Frequencies
Analyzing specific error code frequencies relative to all 4XX responses identifies the most common malformed or potentially malicious requests.
Three distinct groups of issues emerge as equally likely (excluding the dominant "404 Not Found"): "400 Bad Request" (malformed or invalid requests), "429 Too Many Requests" (rate limiting), and the combination of "403 Forbidden" and "401 Unauthorized" (authentication and authorization problems). A long tail follows, including "422 Unprocessable Entity," "409 Conflict," and "402 Payment Required."
The takeaway: the most common attacks involve sending non-compliant requests, brute force efforts (rate limiting accounts for 24% of generated 4XXs), and attempting to access resources with invalid credentials or insufficient permission.
WAF Trigger Categories
Examining why calls were blocked — particularly those returning 400-level codes — requires looking at what triggered the Cloudflare WAF. The OWASP and Cloudflare Managed Rulesets scan for fingerprints of known vulnerabilities such as SQLi and XSS. When a request triggers a managed rule, it is assigned to the first threat identified, even if it matches multiple categories.
User-Agent anomaly is the most common reason for blocked traffic, typically triggered by a missing or malformed User-Agent header that offers no credible client information. Cross-site scripting is the next most frequent trigger, followed by a long tail of other identified anomalies.
Bottom Line
More than one in two requests processed is now an API call. Banking, Retail, and Financial Services lead in adoption and growth, and API traffic is increasing at twice the rate of HTML traffic. That trajectory makes API security an increasingly high-value target for new protection solutions aimed at safeguarding customer data.
