An API response is the data a server sends back after a client makes a request. It can be a JSON object, status code, headers, or an error message. In secure systems, the response should include only the information the client truly needs.
API responses matter because they are a common place for accidental data exposure. If a response includes secrets such as OTPs, session tokens, internal IDs, or personal data, an attacker who can call the endpoint may be able to read them directly. This can turn a normal login, password reset, or account lookup flow into an account-takeover path.
Defenders reduce risk by defining strict response schemas, filtering sensitive fields, validating authorization before returning data, and redacting secrets from logs and debug traces. Secure API design is not only about blocking requests; it is also about making sure the server never sends back more than it should.