What it means
It defines contracts for authentication, authorization, validation, confidentiality, integrity, rate control, error handling, versioning, and monitoring.
Why it matters
Interfaces concentrate trust assumptions and often remain exposed longer than the components behind them, making them a frequent source of systemic weakness.
Practical focus
- Document data, identity, trust, and failure assumptions
- Validate every input at the receiving boundary
- Use least privilege and explicit authorization
- Version, monitor, and retire interfaces deliberately
Common mistakes
- Trusting data because it came from an internal service
- Returning sensitive error detail
- Sharing one broad service credential
- Changing an interface without impact analysis for consumers
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: