API governance is the set of policies, standards, and technical controls that govern how application programming interfaces are designed, published, authenticated, authorized, and monitored. It helps prevent APIs from exposing more data or functionality than they should, especially in cloud services, SaaS platforms, and AI workflows where APIs are often the main data path.
In cyber security, API governance matters because weak controls can lead to broken object-level authorization, excessive data sharing, shadow APIs, and untracked integrations. Defenses usually include API inventory, least-privilege access, schema validation, rate limiting, logging, secrets management, and review of data fields returned by each endpoint. Attackers often abuse undocumented endpoints or overly permissive tokens to pull records, modify business logic, or move laterally through connected services. Good governance makes API access intentional, auditable, and harder to misuse.