Akamai API Security Integration

If you use Akamai API Security, you can connect it to your Sensedia gateways so that Akamai discovers and monitors your APIs from real traffic. Once the integration is enabled, every request that passes through your gateways is forwarded to Akamai API Security as traffic metadata — no agent to install, no change to your APIs, and no change to how your consumers call them.

Akamai then builds an inventory of your APIs, assigns risk scores, and raises security findings and incidents from what it observes.

This integration sends traffic metadata only. Request and response bodies are not sent to Akamai in the current state of the integration. Traffic is sent for discovery and monitoring — the integration does not apply Akamai policy at your Sensedia gateways and cannot block requests. See What data is sent.

How it works

Your gateways already publish an analytics event for every request they handle. The integration adds a dedicated exporter that reads those events and forwards them to Akamai API Security:

  1. A request reaches one of your gateways and is handled normally.

  2. The gateway publishes an analytics event for that request.

  3. The Akamai exporter reads the event, converts it to the format Akamai expects, and sends it to your Akamai engine.

A few properties of this flow are worth knowing, because they explain what you will and won’t see:

  • Your API traffic is never affected. The exporter runs outside the request path. It does not add latency to your APIs, and it cannot block or delay a call to your backend.

  • Events are sent in batches — up to 100 events or every 500 milliseconds, whichever comes first. Counters on the Akamai side therefore update with a short delay rather than instantly.

  • Delivery is best-effort. If your Akamai engine is unreachable, the affected events are discarded rather than retried or queued. You lose visibility for that period; your API traffic is unaffected.

  • Each environment is isolated. Credentials and the destination engine are configured per environment, and an environment that has not been explicitly enabled sends nothing.

What data is sent

For each request handled by your gateways, the integration sends:

  • HTTP method

  • Request path and query string

  • Request and response headers

  • Response status code

  • Timestamps

How to set up the integration

To set up the integration, you need an active Akamai API Security subscription, with permission to create integrations in the Akamai platform.

Enabling the integration starts with a support ticket. Open it before you begin, or right after you collect the credentials in the steps below — the Sensedia team needs them to complete the setup.

Configuration

Configuration happens in two places: you create the traffic source for Sensedia in Akamai API Security, then send the resulting credentials to Sensedia.

  1. Create the Sensedia traffic source in Akamai

    In Akamai API Security, add a traffic source integration using the Sensedia tile and select the destination engine it should send traffic to. Refer to the Akamai documentation for where these options live.

  2. Set x-forwarded-host as the original host header

    In the integration’s settings, configure x-forwarded-host as the first entry used to determine the original host.

    Traffic reaches Akamai from your gateway, so without this the inventory shows a single host — the gateway’s. With it, each discovered API shows your own hostname. Configure it before sending production traffic: it applies only to APIs discovered after the change.

  3. Collect the credentials

    From the integration you just created, collect the engine URL, source index and source key.

  4. Open a support ticket with Sensedia

    Open a ticket with Sensedia Support requesting the Akamai API Security integration, and include:

    • The environment you want to monitor

    • The engine URL and source index from the previous step

    • The source key, shared through a secure channel — it is a secret, so do not paste it into the ticket body unless your support channel is approved for credentials

    Sensedia configures the credentials for your environment and enables it.

  5. Confirm that traffic is arriving

    In Akamai API Security, confirm that your integration is receiving traffic and that the request count grows as traffic flows. Allow a few minutes after the first requests.

Rotating your source key

If you rotate the source key of your integration in Akamai, send the new key to Sensedia Support through a secure channel.

Until the new key is configured on the Sensedia side, Akamai rejects the events we send. Because delivery is best-effort with no retry, those events are discarded — they are not queued and cannot be recovered afterwards.

Troubleshooting

No traffic arrives at all

The most common cause is that the environment has not been enabled on the Sensedia side — environments send nothing until they are explicitly enabled. Confirm with Sensedia Support that your environment is active, and that the engine URL, source index and source key configured for it match the ones in your Akamai integration.

Traffic stopped arriving after I rotated my source key

Events sent with the previous key are rejected by Akamai, and the exporter does not retry them. Send the new source key to Sensedia Support through a secure channel; traffic resumes once the credential is updated for your environment. Events handled while the keys did not match are not recovered.

Akamai accepts the traffic but no APIs are discovered

This can happen when the traffic source type configured on the Sensedia side does not match the one issued for the Sensedia integration. Confirm it with Sensedia Support.

The request count in Akamai does not match what my gateway handled

Events are delivered in batches, so a difference right after a burst of traffic is expected. A difference that persists may indicate that events were discarded because the Akamai engine was unreachable.

Thanks for your feedback!
EDIT

Share your suggestions with us!
Click here and then [+ Submit idea]