A hosted API is a network-accessible interface provided by a remote service. Software sends requests-such as prompts or data-to the provider, which processes them using an AI model and returns results. Unlike a locally installed model, the model and its infrastructure are managed outside the organization.
Hosted APIs matter for security because data may leave an organization’s systems, and service use can depend on external vendors, model versions, and contractual terms. In attacks, compromised credentials or exposed API keys can let an unauthorized party use the service or access submitted data. Defenders should inventory API integrations, restrict and rotate credentials, monitor requests, review data-handling terms, and verify which model or provider a product uses. For procurement restrictions, tracing these dependencies helps determine whether a third-party tool routes requests to a prohibited external model.