- Home
- API Security Software
- Wallarm API Security
Wallarm API Security
Wallarm says it is headquartered in Austin, Texas.
What it is
Wallarm API Security discovers APIs and provides real-time protection against attacks, misuse, and account takeover. It covers REST, GraphQL, gRPC, SOAP, and WebSocket APIs without needing an API specification, and can identify shadow, zombie, and rogue APIs while building OpenAPI specifications from live traffic. Its protections block injection, BOLA, broken authentication, and zero-day exploits; behavior analysis detects credential stuffing, malicious bots, account takeover, and L7 DDoS. The product can surface APIs handling personal, payment, credential, or health data and map that information to compliance scope. API Leak Management scans public sources for keys, tokens, and credentials linked to customer domains. Deployment choices include managed Security Edge and self-hosted Kubernetes, cloud VM, or API gateway connector setups. The free tier costs nothing and allows 500,000 requests per month for three users per company, excluding vulnerability assessment and API Abuse Prevention. After that monthly quota is exceeded, console access and integrations are disabled. Paid core subscriptions require contacting sales for pricing.
For and against
For
- Covers five API protocols without a specification.
- Finds shadow, zombie, and rogue APIs.
- Blocks listed attacks in real time.
- Free tier allows 500,000 requests monthly.
- Supports managed and self-hosted deployment.
Against
- Free tier excludes vulnerability assessment.
- Free tier excludes API Abuse Prevention.
- Console and integrations disable beyond the monthly quota.
- Paid core plans require contacting sales.
The verdict
Wallarm combines API discovery, attack protection, abuse detection, and sensitive-data mapping. The free tier has a defined request quota and feature exclusions, while paid-plan pricing requires a sales inquiry.
Who it suits
It suits teams seeking API discovery, runtime protection, and sensitive-data visibility across multiple API protocols. Organizations can choose managed Security Edge or self-hosted deployment.
Plans and prices
Security Edge Free Tier
Up to 500,000 requests/month · 3 users/company · excludes vulnerability assessment and API Abuse Prevention
Read 29 Sep 2026 · docs.wallarm.com
Cloud Native WAAP
Pricing by request to sales · supports all API protocols · 6 months event storage · unlimited users
Read 29 Sep 2026 · docs.wallarm.com
WAAP + Advanced API Security
Pricing by request to sales · 6 months event storage · unlimited users
Read 29 Sep 2026 · docs.wallarm.com
On the record
- Abuse prevention
- It detects credential stuffing, account takeover, malicious bots, and L7 DDoS using behavior analysis.wallarm.com · read 29 Sep 2026
- API discovery
- It finds shadow, zombie, and rogue APIs and can auto-build OpenAPI specifications from live traffic.wallarm.com · read 29 Sep 2026
- Attack protection
- It blocks attacks including injection, BOLA, broken authentication, and zero-day exploits in real time.wallarm.com · read 29 Sep 2026
- Compliance
- Wallarm states that it is SOC 2 Type 2 compliant.wallarm.com · read 29 Sep 2026
- Deployment
- Wallarm supports managed Security Edge deployment and self-hosted deployment options including Kubernetes, cloud VMs, and API gateway connectors.docs.wallarm.com · read 29 Sep 2026
- Free tier limits
- The Security Edge Free Tier allows 500,000 requests per month and disables console access and integrations after the monthly quota is exceeded.docs.wallarm.com · read 29 Sep 2026
- Integrations
- The product page lists Splunk, Sumo, QRadar, Jira, PagerDuty, OpsGenie, and Slack for event routing.wallarm.com · read 29 Sep 2026
- Leaked credentials
- API Leak Management scans public sources for API keys, tokens, and credentials associated with customer domains.wallarm.com · read 29 Sep 2026
- Paid plans
- Wallarm says core subscription plans are activated by contacting sales.docs.wallarm.com · read 29 Sep 2026
- Product
- Wallarm API Security discovers APIs and protects them in real time against OWASP API Top 10 attacks, abuse, and account takeover.wallarm.com · read 29 Sep 2026
- Protocols
- The product covers REST, GraphQL, gRPC, SOAP, and WebSocket APIs without requiring an API specification.wallarm.com · read 29 Sep 2026
- Sensitive data
- It surfaces APIs moving personal, payment, credential, or health data and maps that data to compliance scope.wallarm.com · read 29 Sep 2026
