{"id":2248,"date":"2026-07-31T04:25:04","date_gmt":"2026-07-31T04:25:04","guid":{"rendered":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/"},"modified":"2026-07-31T04:25:04","modified_gmt":"2026-07-31T04:25:04","slug":"how-to-protect-api-endpoints","status":"publish","type":"post","link":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/","title":{"rendered":"How to Protect API Endpoints in Production"},"content":{"rendered":"

An exposed API endpoint is not just an application route. It is a direct path to data, compute, billing events, and administrative actions. Learning how to protect API endpoints<\/strong> means designing every request path to assume that clients can be spoofed, inputs can be hostile, and credentials can eventually leak.<\/p>\n

For development teams, the goal is not to add every available security control. It is to apply the right controls at the right layer, then make those controls observable and repeatable through your deployment workflow.<\/p>\n

Start with an API attack surface review<\/h2>\n

Before adding middleware or configuring a firewall, map what is actually exposed. Inventory public endpoints, internal service endpoints, administrative routes, webhooks, and any legacy API versions still accepting traffic.<\/p>\n

For each endpoint, document who should call it, what data it accepts, what data it returns, and what action it can trigger. A public product catalog endpoint has a different risk profile than an endpoint that resets passwords, exports customer records, or provisions cloud resources.<\/p>\n

This review frequently reveals avoidable exposure. Debug endpoints left enabled, unauthenticated health checks that disclose version details, old API versions, and overly broad administrative APIs are common examples. If an endpoint does not need public access, keep it on a private network or require service-to-service authentication.<\/p>\n

Use strong authentication for every sensitive route<\/h2>\n

Authentication establishes who is making a request. For browser users, this may be a session cookie. For mobile apps, external integrations, or machine-to-machine traffic, it is commonly an OAuth access token, signed JWT, API key, or mutual TLS certificate.<\/p>\n

The method depends on the client and risk level. API keys are straightforward for server-side integrations, but they should be treated like passwords: generate them with sufficient entropy, show them only once when possible, scope them narrowly, and allow rotation without downtime. Never place long-lived secrets in frontend code, mobile binaries, repositories, logs, or query strings.<\/p>\n

JWTs can work well for distributed systems, but they are easy to misuse. Validate the signature, issuer, audience, expiration, and expected signing algorithm on every request. Do not trust a token simply because it parses correctly. Keep token lifetimes short, and use a refresh flow where the user experience requires longer access.<\/p>\n

For high-value operations, add stronger controls. Require reauthentication, step-up authentication, or signed requests for actions such as changing payment details, creating privileged users, or exporting sensitive data.<\/p>\n

Separate user identity from service identity<\/h3>\n

A service calling another service should not reuse an end-user token or a shared API key intended for a different workload. Give workloads their own identities and permissions. This makes access easier to revoke and gives your logs a clear answer when a service behaves unexpectedly.<\/p>\n

In containerized or cloud environments, avoid distributing a single secret to every instance. Use short-lived workload credentials where your architecture supports them, and store any required secrets in a managed secret system rather than environment files copied between servers.<\/p>\n

Enforce authorization on every request<\/h2>\n

Authentication is only half of the decision. A valid user should not automatically be able to read or modify every record in your application.<\/p>\n

Authorization must happen server-side for every object and action. If a request is made to `\/accounts\/482\/invoices`, verify that the authenticated principal is allowed to access account 482. Do not rely on hidden UI controls, client-side role checks, or the assumption that users will only request IDs assigned to them.<\/p>\n

This is where broken object-level authorization appears. An attacker changes an ID, UUID, tenant identifier, or resource path and receives another customer’s data because the API checked identity but not ownership.<\/p>\n

Use a deny-by-default model. Define permissions around actions such as `invoice.read`, `invoice.refund`, or `project.member.manage`, then assign only the permissions required by a user, role, or service. For multi-tenant applications, include tenant boundaries in the authorization decision every time.<\/p>\n

Validate input before it reaches business logic<\/h2>\n

Every API request is untrusted input, including fields supplied by authenticated users and internal services. Validate request bodies, path parameters, query strings, headers, content types, and file uploads against an explicit schema.<\/p>\n

Check data types, allowed values, lengths, formats, and numeric ranges. Reject unknown fields when practical, especially on administrative or financial endpoints. This reduces accidental misuse and prevents clients from setting fields your API did not intend to expose, such as `role`, `isAdmin`, or internal pricing values.<\/p>\n

Use parameterized database queries and safe ORM patterns to prevent injection. Avoid passing client input directly into shell commands, template engines, filesystem paths, or dynamic queries. When accepting URLs for webhooks, imports, or previews, protect against server-side request forgery by restricting outbound destinations and blocking access to private network ranges.<\/p>\n

Return useful but limited validation errors. A client needs to know that `email` is invalid. It does not need a stack trace, database error, framework version, or internal hostname.<\/p>\n

Add rate limits, quotas, and abuse controls<\/h2>\n

Rate limiting protects availability and raises the cost of brute-force attacks, credential stuffing, scraping, and expensive automated requests. Apply limits by identity when authenticated, but also consider source IP, API key, tenant, route, and device signals. A limit based only on IP can punish users behind a shared corporate network, while a limit based only on account ID may be bypassed with newly created accounts.<\/p>\n

Use tighter limits for login, password reset, token creation, search, report generation, file uploads, and endpoints that trigger expensive background work. Return `429 Too Many Requests` with a clear retry signal so legitimate clients can back off cleanly.<\/p>\n

Rate limits should not be your only defense. Queue resource-intensive work, set request body limits and timeouts, and cap pagination sizes. A request can be valid and still be expensive enough to affect other customers if it asks for an unbounded export or a complex query.<\/p>\n

At the network edge, DDoS protection<\/a>, a cloud firewall, and CDN or proxy rules can reduce unwanted traffic before it consumes application resources. These controls are especially useful for public APIs, but they do not replace authorization inside the application.<\/p>\n

Protect data in transit, at rest, and in responses<\/h2>\n

Require HTTPS for all API traffic and redirect or reject plaintext requests. Configure modern TLS, secure cookies where cookies are used, and HSTS for browser-facing domains. Between internal services, encrypt traffic as well when it crosses untrusted networks or infrastructure boundaries.<\/p>\n

Minimize what each endpoint returns. Do not serialize complete database objects by default. Define response models that expose only fields the client needs, and apply field-level access rules when different roles see different data.<\/p>\n

Sensitive values should be encrypted at rest where appropriate, but encryption alone does not solve access control. The application, backups, logs, analytics tools, and support workflows must all limit who can read decrypted data.<\/p>\n

Be equally careful with logs. Redact authorization headers, cookies, API keys, passwords, reset tokens, and personally identifiable information. Logs are valuable during an incident, but they become a second breach path when they contain reusable credentials.<\/p>\n

Monitor API behavior and make incidents actionable<\/h2>\n

You cannot protect what you cannot see. Record structured events for authentication failures, authorization denials, rate-limit responses, privilege changes, token creation, unusual export activity, and changes to API configuration.<\/p>\n

Track both security and operational signals. A sudden increase in `401`, `403`, `404`, or `429` responses can indicate probing or a broken integration. A rise in latency, large response sizes, or database load on a specific route may indicate abuse before it becomes an outage.<\/p>\n

Alerts need context. Include the endpoint, request ID, tenant or service identity when safe to do so, source information, and deployment version. This helps an on-call engineer distinguish a customer integration issue from a credential attack without searching through disconnected systems.<\/p>\n

Create an incident path before you need it: revoke a compromised key, disable a client, rotate secrets, block a source, roll back a release, and preserve relevant logs. Automation can make these actions faster, but keep high-impact actions behind appropriate approval and access controls.<\/p>\n

Build endpoint security into deployment<\/h2>\n

Security controls drift when they depend on manual changes. Put API gateway policies, firewall rules, schema validation, secret rotation processes, and infrastructure configuration under version control where possible. Review changes through the same workflow used for application code.<\/p>\n

Run dependency scanning, static analysis, and API tests in CI. Test the negative cases, not only successful requests: expired tokens, missing permissions, malformed payloads, oversized uploads, cross-tenant object IDs, and repeated login attempts. A security test that proves a request is denied is often more valuable than another test proving the happy path works.<\/p>\n

For teams deploying on LetsCloud, combine application-level controls with practical infrastructure layers such as Cloud Firewall, DDoS Protection, and API-driven resource management<\/a>. Keep public entry points intentional, restrict management access, and automate repeatable configurations as environments scale.<\/p>\n

API security is an operating practice, not a one-time hardening task. Start with the endpoints that can expose customer data or trigger costly actions, make denial the default, and keep improving the controls as your application and traffic patterns change.<\/p>\n","protected":false},"excerpt":{"rendered":"

Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.<\/p>\n","protected":false},"author":1,"featured_media":2249,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2248","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-community","entry"],"yoast_head":"\nHow to Protect API Endpoints in Production - LetsCloud Blog<\/title>\n<meta name=\"description\" content=\"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Protect API Endpoints in Production - LetsCloud Blog\" \/>\n<meta property=\"og:description\" content=\"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/\" \/>\n<meta property=\"og:site_name\" content=\"LetsCloud Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/LetsCloudOfficial\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-31T04:25:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2019\/06\/og-image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"LetsCloud Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@letscloudInc\" \/>\n<meta name=\"twitter:site\" content=\"@letscloudInc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"LetsCloud Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/\"},\"author\":{\"name\":\"LetsCloud Team\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/#\\\/schema\\\/person\\\/db5dc1b68cac3498c8aeb0b56f1dbdf6\"},\"headline\":\"How to Protect API Endpoints in Production\",\"datePublished\":\"2026-07-31T04:25:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/\"},\"wordCount\":1492,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/how-to-protect-api-endpoints-in-production-featured.webp\",\"articleSection\":[\"Community\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/\",\"url\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/\",\"name\":\"How to Protect API Endpoints in Production - LetsCloud Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/how-to-protect-api-endpoints-in-production-featured.webp\",\"datePublished\":\"2026-07-31T04:25:04+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/#\\\/schema\\\/person\\\/db5dc1b68cac3498c8aeb0b56f1dbdf6\"},\"description\":\"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/how-to-protect-api-endpoints-in-production-featured.webp\",\"contentUrl\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/how-to-protect-api-endpoints-in-production-featured.webp\",\"width\":1536,\"height\":1024,\"caption\":\"How to Protect API Endpoints in Production\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/how-to-protect-api-endpoints\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Protect API Endpoints in Production\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/\",\"name\":\"LetsCloud Blog\",\"description\":\"Everything you need. Nothing you don\u2019t.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/#\\\/schema\\\/person\\\/db5dc1b68cac3498c8aeb0b56f1dbdf6\",\"name\":\"LetsCloud Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g\",\"caption\":\"LetsCloud Team\"},\"url\":\"https:\\\/\\\/www.letscloud.io\\\/blog\\\/author\\\/letscloud\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Protect API Endpoints in Production - LetsCloud Blog","description":"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/","og_locale":"en_US","og_type":"article","og_title":"How to Protect API Endpoints in Production - LetsCloud Blog","og_description":"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.","og_url":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/","og_site_name":"LetsCloud Blog","article_publisher":"https:\/\/www.facebook.com\/LetsCloudOfficial","article_published_time":"2026-07-31T04:25:04+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2019\/06\/og-image.png","type":"image\/png"}],"author":"LetsCloud Team","twitter_card":"summary_large_image","twitter_creator":"@letscloudInc","twitter_site":"@letscloudInc","twitter_misc":{"Written by":"LetsCloud Team","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#article","isPartOf":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/"},"author":{"name":"LetsCloud Team","@id":"https:\/\/www.letscloud.io\/blog\/#\/schema\/person\/db5dc1b68cac3498c8aeb0b56f1dbdf6"},"headline":"How to Protect API Endpoints in Production","datePublished":"2026-07-31T04:25:04+00:00","mainEntityOfPage":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/"},"wordCount":1492,"commentCount":0,"image":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#primaryimage"},"thumbnailUrl":"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2026\/07\/how-to-protect-api-endpoints-in-production-featured.webp","articleSection":["Community"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/","url":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/","name":"How to Protect API Endpoints in Production - LetsCloud Blog","isPartOf":{"@id":"https:\/\/www.letscloud.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#primaryimage"},"image":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#primaryimage"},"thumbnailUrl":"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2026\/07\/how-to-protect-api-endpoints-in-production-featured.webp","datePublished":"2026-07-31T04:25:04+00:00","author":{"@id":"https:\/\/www.letscloud.io\/blog\/#\/schema\/person\/db5dc1b68cac3498c8aeb0b56f1dbdf6"},"description":"Learn how to protect API endpoints with practical controls for authentication, authorization, rate limits, input validation, monitoring, and deployment.","breadcrumb":{"@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#primaryimage","url":"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2026\/07\/how-to-protect-api-endpoints-in-production-featured.webp","contentUrl":"https:\/\/www.letscloud.io\/blog\/wp-content\/uploads\/2026\/07\/how-to-protect-api-endpoints-in-production-featured.webp","width":1536,"height":1024,"caption":"How to Protect API Endpoints in Production"},{"@type":"BreadcrumbList","@id":"https:\/\/www.letscloud.io\/blog\/how-to-protect-api-endpoints\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.letscloud.io\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Protect API Endpoints in Production"}]},{"@type":"WebSite","@id":"https:\/\/www.letscloud.io\/blog\/#website","url":"https:\/\/www.letscloud.io\/blog\/","name":"LetsCloud Blog","description":"Everything you need. Nothing you don\u2019t.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.letscloud.io\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.letscloud.io\/blog\/#\/schema\/person\/db5dc1b68cac3498c8aeb0b56f1dbdf6","name":"LetsCloud Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ccae1dbb34f990736eba7967e6dfaf22ad95b4790915f19a175e53d146ad0a71?s=96&d=mm&r=g","caption":"LetsCloud Team"},"url":"https:\/\/www.letscloud.io\/blog\/author\/letscloud\/"}]}},"_links":{"self":[{"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/posts\/2248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/comments?post=2248"}],"version-history":[{"count":0,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/posts\/2248\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/media\/2249"}],"wp:attachment":[{"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/media?parent=2248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/categories?post=2248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.letscloud.io\/blog\/wp-json\/wp\/v2\/tags?post=2248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}