1# Cloudflare API Shield Reference
2 
3Expert guidance for API Shield - comprehensive API security suite for discovery, protection, and monitoring.
4 
5## Reading Order
6 
7| Task | Files to Read |
8|------|---------------|
9| Initial setup | README → configuration.md |
10| Implement JWT validation | configuration.md → api.md |
11| Add schema validation | configuration.md → patterns.md |
12| Detect API attacks | patterns.md → api.md |
13| Debug issues | gotchas.md |
14 
15## Feature Selection
16 
17What protection do you need?
18 
19```
20├─ Validate request/response structure → Schema Validation 2.0 (configuration.md)
21├─ Verify auth tokens → JWT Validation (configuration.md)
22├─ Client certificates → mTLS (configuration.md)
23├─ Detect BOLA attacks → BOLA Detection (patterns.md)
24├─ Track auth coverage → Auth Posture (patterns.md)
25├─ Stop volumetric abuse → Abuse Detection (patterns.md)
26└─ Discover shadow APIs → API Discovery (api.md)
27```
28 
29## In This Reference
30 
31- **[configuration.md](configuration.md)** - Setup, session identifiers, rules, token/mTLS configs
32- **[api.md](api.md)** - Endpoint management, discovery, validation APIs, GraphQL operations
33- **[patterns.md](patterns.md)** - Common patterns, progressive rollout, OWASP mappings, workflows
34- **[gotchas.md](gotchas.md)** - Troubleshooting, false positives, performance, best practices
35 
36## Quick Start
37 
38API Shield: Enterprise-grade API security (Discovery, Schema Validation 2.0, JWT, mTLS, BOLA Detection, Auth Posture). Available as Enterprise add-on with preview access.
39 
40## See Also
41 
42- [API Shield Docs](https://developers.cloudflare.com/api-shield/)
43- [API Reference](https://developers.cloudflare.com/api/resources/api_gateway/)
44- [OWASP API Security Top 10](https://owasp.org/www-project-api-security/)
45