{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41304,"path":"platform-security/instance-security-hardening-settings/sc-api-web-service.md","title":"API and web service","bundle":null,"doc_type":null,"release":"australia","body":"\n# API and web service\n\nThe API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.\n\nSpecific controls in this category address input validation by service type such as XDS schema validation for SOAP web services or Denial of Service protection for graphQL APIs.\n\n-   **[Validate SOAP content type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-soap-content-type-checking.md)**  \nUse the **glide.soap.require\\_content\\_type\\_xml** property to enable validation of a content type as text/xml and protect against invalid SOAP requests.\n-   **[Prevent OAuth Clients from Using Implicit Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-prevent-oauth-clients-from-using-implicit-grant.md)**  \nUse a system property to avoid the use of the implicit grant type.\n-   **[Require authorization for PDF requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-pdf-requests.md)**  \nUse the **glide.basicauth.required.pdf** property to designate if incoming PDF requests should require basic authentication.\n-   **[Require Authentication on Event Management HTTP Processor \\[New in Security Center 1.3, Updated in 1.5, and removed in 2.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authentication-on-event-management-http-processor.md)**  \nLearn how to establish secure basic authentication for inbound Amazon Simple Notification Service \\(SNS\\) requests when the Event Management plugin \\(**com.glideapp.itom.snac**\\) is enabled.\n-   **[Require authorization for SOAP requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-soap-request-authorization.md)**  \nUse the **glide.basicauth.required.soap** property to designate if incoming SOAP requests should require basic authorization.\n-   **[Require authorization for unload requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-unload-requests.md)**  \nUse the **glide.basicauth.required.unl** \\(useUnloadFormat\\) property to designate if incoming unload requests should require basic authentication.\n-   **[Require authorization for csv requests \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-csv-requests.md)**  \nUse the **glide.basicauth.required.csv** property to designate if incoming CSV \\(Comma-Separated Values\\) requests should require basic authentication.\n-   **[Require authorization for excel requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-excel-request-authorization.md)**  \nUse the **glide.basicauth.required.excel** property to designate if incoming Excel requests should require basic authentication.\n-   **[Require authorization for import requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-import-request-authorization.md)**  \nUse the **glide.basicauth.required.importprocessor** property to designate if incoming import requests should require basic authentication.\n-   **[Require authorization for JSONv2 request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-jsonv2-request-authorization.md)**  \nUse the **glide.basicauth.required.jsonv2** property to designate if incoming JSONv2 requests should require basic authorization.\n-   **[Require authorization for WSDL request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-wsdl-request-authorization.md)**  \nUse the **glide.basicauth.required.wsdl** property to designate if incoming WSDL \\(Web Services Description Language\\) requests should require basic authentication.\n-   **[Require authorization for XML requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xml-request-authorization.md)**  \nUse the **glide.basicauth.required.xml** property to designate if incoming XML requests should require basic authentication.\n-   **[Require authorization for XML output requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xml-output-authorization.md)**  \nConfigure this property so that basic authorization is required for all inbound XMLOutputProcessor requests.\n-   **[Require Authorization for XSD Requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xsd-request-authorization.md)**  \nUse the **glide.basicauth.required.xsd** property to designate if incoming XSD \\(XML Schema Definition\\) requests should require basic authentication.\n-   **[Require authorization for script requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-script-request-authorization.md)**  \nUse the **glide.basicauth.required.scriptedprocessor** property to designate if incoming script requests should require basic authentication.\n-   **[Require authorization for SCHEMA requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-schema-request-authorization.md)**  \nUse the **glide.basicauth.required.schema** property to require basic authorization for all Inbound Table Schema Processor requests.\n-   **[Require authorization for RSS requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-rss-request-authorization.md)**  \nUse the **glide.basicauth.required.rss** property to designate if incoming RSS requests should require basic authentication.\n-   **[Require authorization for API requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-api-request-authorization.md)**  \nUse the **glide.basicauth.required.api** property to enhance security for basic authorization for incoming REST requests.\n\n**Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)\n\n"}}