API Shield review

API Shield bundles mTLS client certificates, API discovery, schema validation, and sequence analytics for Enterprise API estates. The mTLS part is useful and partially available to everyone. Issuing client certificates from Cloudflare’s CA and enforcing them in WAF rules works well for locking down device or service traffic.

Discovery and schema validation do what they claim: upload an OpenAPI spec, block requests that don’t conform. That’s real defense-in-depth for a public API.

The regex support undermines the schema validation, though. The patterns in your OpenAPI spec run against a limited regex engine, not anything close to JavaScript’s, and there is no clear documentation of where the line sits. A pattern that works fine in a zod or Hono route definition can be one API Shield misreads, and when it misreads one it fails closed and blocks everything that touches it. The workaround is dumbing patterns down or moving that validation into your own code, which defeats the point of validating at the edge.

Schema validation and endpoint management have opened up to every plan, which is real progress. The catch is the body inspection cap: 1 KB on Free and 8 KB on Pro and Business, and a request body over the cap skips validation entirely. Discovery, schema learning, and the rest of the suite still sit behind Enterprise contracts, while plain WAF custom rules cover much of the same ground. A competent team with a good ruleset can get most of the way there. The score reflects access and value, not raw capability.