Here's the list of best practices in securing RESTful API. 1. Always Use HTTPS - Traffic must be encrypted 2. Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable. 3. Consider Oauth 4. Adding Timestamp in Request - This will prevent very basic replay attacks from people who are trying to brute force your system 5. Input Parameter Validation - Put strong validation checks and reject the request immediately if validation fails. 6. Use Auditing and Logging - Any subject or entity can be audited