API contracts
Checking every request against the API's OpenAPI contract, and refusing what it does not declare.
Object guard
Enumeration and walks through object identifiers per consumer, and a budget of distinct objects.
API reports
Shadow and zombie endpoints, contract drift, and which credentials apply to which endpoint.