API draining is the repeated use of a legitimate application programming interface until it exhausts quota, burns through prepaid credits, or drives up billed usage. Unlike a direct exploit, the requests themselves may look valid: the caller may have a real key, follow normal authentication rules, and still create harmful cost pressure by sending traffic at scale.
In cyber security, API draining matters because it turns access into expense. Attackers can abuse AI, cloud, or SaaS APIs to consume tokens, rate limits, and account budgets, sometimes as a way to disrupt services or hide inside ordinary-looking activity. Defenders look for unusual request volume, strange timing, repeated low-value calls, and unexpected billing spikes. Alerts on quota exhaustion, spend anomalies, and per-key usage can help stop abuse before it becomes a financial sink.