Salesforce Docs Portal

Correlating Risk Using Akamai API Security

Use Akamai for risk correlation to map external security findings to the right services in Portfolio. Teams get one view to triage risk, track incidents, and remediate faster. To enable this correlation, configure an Akamai API Security scanner that connects your Akamai account, runs scheduled scans, and surfaces mapped findings on related services in Portfolio. The scanner doesn’t import or register third-party services. It correlates risk scores, findings, and incidents for APIs and MCP services in one governance workflow.

The integration relies on a bidirectional sync between your MuleSoft and Akamai API Security tenants. You connect the two tenants with credentials in each direction: Akamai reads your API assets and instances from MuleSoft so it can match its security observations to the correct APIs, and the scanner pulls the resulting findings and incidents back into Portfolio.

Akamai Scanner vs. Import Scanners

Most provider scanners discover metadata in external platforms and import services into Portfolio catalogs. The Akamai API Security scanner works differently: instead of creating new services, it enriches existing ones with Akamai security data.

Before You Begin

Before setting up the Akamai scanner, make sure you have:

  • Exchange Administrator permission in the target business group.

  • Akamai Security base URL, client ID, and client secret.

  • Access to apply the Akamai correlation policy in the environments you want to scan.

  • Existing APIs and MCP services in Portfolio catalogs for correlation targets.

For credential and role details, see Scanner Prerequisites by Provider.

Monitor Traffic Through Omni Gateway

Akamai observes traffic at the Akamai edge, which is traffic between external clients and your APIs on domains you own and control. To also have Akamai analyze traffic that passes through Omni Gateway but isn’t inspected at the Akamai edge, apply the Akamai API Security (Omni Gateway) policy to your API instances. This traffic includes:

  • Internal traffic between services (east-west traffic).

  • External traffic to endpoints you can’t register at the Akamai edge, such as MuleSoft-managed CloudHub endpoints.

The policy forwards this traffic to Akamai API Security in asynchronous batches. Forwarding doesn’t block requests. If the Akamai engine is unavailable, forwarding fails open and your API traffic isn’t affected.

Akamai owns and maintains this policy, and it’s separate from the Akamai correlation policy that the scanner applies. For findings from forwarded traffic to appear on the related API in Portfolio, apply both policies to the API instance. The correlation policy adds the correlation data that Akamai uses to match a finding to its API, and the Akamai API Security (Omni Gateway) policy forwards that data with the traffic it captures.

You create the policy in Akamai API Security, publish it to Anypoint Exchange, and apply it to your APIs in Anypoint API Manager.

To monitor traffic, set PREVENTION_ENABLED to false when you apply the policy. In this capture-only configuration, the policy forwards traffic for analysis without blocking requests.

The policy can also block requests from attackers that Akamai API Security detects and return a 403 response. Blocking is an opt-in control that runs synchronously in the request path, so Akamai engine availability and the policy’s timeout settings can affect your API traffic. Before you enable prevention, review the policy parameters in the Akamai documentation.

Before You Apply the Policy

Make sure you have:

  • API instances that run on Omni Gateway.

  • The Akamai correlation policy applied to those API instances. See Set Up the Akamai Scanner.

  • Network access from Omni Gateway to your Akamai API Security engine over HTTPS.

  • The Admin role in Akamai API Security with the Traffic Source & Prevention permission.

  • Permission to publish assets to Anypoint Exchange and apply policies in Anypoint API Manager.

  • Anypoint CLI with the PDK plugin, Node.js, and Rust installed on the machine where you install the policy. See Prerequisites for Omni Gateway Policy Development Kit (PDK).

Apply the Policy

  1. In Akamai API Security, create a MuleSoft traffic source integration for Omni Gateway, and then download the policy.

    For instructions, see MuleSoft Omni Gateway - Source and Prevention Integration in the Akamai documentation.

  2. In Anypoint Platform, create a connected app that acts on its own behalf (client credentials) with the Exchange Contributor scope, and then copy the client ID and client secret.

    This connected app is separate from the one Akamai uses to read API assets from MuleSoft. For instructions, see Creating Connected Apps in Anypoint Platform.

  3. Configure Anypoint CLI with the connected app credentials, your business group ID, and your environment ID, and then run the installation script included in the policy download.

    The script publishes the policy to Anypoint Exchange. For the commands, see "Step 4: Deploy the Policy" in MuleSoft Omni Gateway - Source and Prevention Integration in the Akamai documentation.

  4. In Anypoint API Manager, apply the Akamai API Security (Omni Gateway) policy in one of these ways:

    • To apply the policy to all APIs in an environment, add it as an automated policy. In Advanced Options, set Rule of application to Omni gateways only. See Applying Automated Inbound Policies.

    • To apply the policy to specific APIs, add it as an inbound policy on each API.

    To capture traffic without blocking requests, set PREVENTION_ENABLED to false. For instructions, see "Step 5: Apply the Policy" in MuleSoft Omni Gateway - Source and Prevention Integration in the Akamai documentation.

  5. Move the Akamai API Security (Omni Gateway) policy to the top of the policy list, above the Akamai correlation policy.

    With this order, the correlation policy adds correlation data to the response before the Akamai API Security (Omni Gateway) policy captures it. If the order is reversed, Akamai receives the traffic without correlation data, so findings from that traffic don’t appear on the related API in Portfolio. No error is reported.

For policy parameters and troubleshooting, see the Akamai documentation for the MuleSoft Omni Gateway integration. You need an Akamai account to view this documentation.

Set Up Tenant Connectivity

The integration uses a bidirectional sync between your MuleSoft tenant and your Akamai API Security tenant. You provision and configure both tenants. Each MuleSoft customer tenant (root organization) connects to one Akamai API Security tenant (for example, <tenant>.nonamesec.com).

Setup involves credentials in both directions:

  • A service account in Akamai, which you configure on the MuleSoft side so the scanner can read findings and incidents from Akamai.

  • A connected app in MuleSoft, which you configure on the Akamai side so Akamai can pull API asset and instance information from MuleSoft.

Complete these steps as an organization administrator:

  1. Create a service account in Akamai API Security.

    In your Akamai API Security tenant, create a service account and note its client ID and client secret.

  2. Configure the scanner in MuleSoft.

    Add an Akamai scanner and enter the Akamai service account credentials (client ID and client secret) and the Akamai base URL, along with a scan frequency. See Set Up the Akamai Scanner.

  3. Create a connected app in MuleSoft.

    In Anypoint Platform, go to Access Management > Connected Apps and create an app that acts on its own behalf (client credentials). Add the Exchange Viewer or Asset Viewer scope so Akamai can read API instance and asset information, then save. Copy the client ID and client secret. For instructions, see Creating Connected Apps in Anypoint Platform.

  4. Configure the sync on the Akamai side.

    In your Akamai API Security tenant, enter the MuleSoft connected app client ID and client secret so Akamai can pull API asset and instance information from MuleSoft.

Set Up the Akamai Scanner

Before you set up the scanner, review the prerequisites for Akamai scanners in Scanner Prerequisites by Provider.

  1. From Platform > Providers, select Akamai.

  2. Click Add Scanner and enter the connection values.

  3. Test the connection.

  4. Enter scanner metadata, such as scanner name, description, frequency, and time.

  5. Apply the Akamai correlation policy to selected environments.

  6. Save the scanner and run a discovery scan.

How the Sync Works

After both tenants are connected, data flows in two directions:

MuleSoft to Akamai

Akamai periodically pulls API instance and asset information from MuleSoft (typically every few hours) and adds it to its API security inventory. Akamai correlates these API instances with the north-south traffic it observes, so it can attach MuleSoft context — such as organization ID, environment ID, and API instance ID — to the endpoints it monitors. The pull runs at the root organization level.

Akamai to MuleSoft

The scanner pulls security findings and incidents from Akamai on the schedule you set, then correlates and stores them so they appear on the related services in Portfolio.

For Akamai to observe and correlate traffic, the Akamai correlation policy must be applied to your API instances. This out-of-the-box policy (for Omni Gateway and Mule gateways) stamps correlation headers on API responses so Akamai can match observed traffic to the correct MuleSoft API. Akamai observes north-south traffic only for domains you own and control.

Review Scanner Detail Tabs

After you select a configured Akamai scanner from the provider list, use the scanner detail tabs to monitor scanner status, related services, and configuration values.

For common tab behavior across scanners, see Viewing Scanner History and Settings. For Akamai scanners, the Overview tab highlights correlation policy status and shows whether existing services are being updated with Akamai risk, findings, and incident data. The Services tab lists services associated with the scanner and shows which existing services are receiving correlated Akamai security data. The Settings tab shows scanner configuration values, including schedule and provider connection values, and provides options to edit or delete the scanner.

Apply Missing Correlation Policies

If some environments show that the correlation policy isn’t applied, you can apply missing policies from the scanner detail page:

  1. Open Platform > Providers and select the configured Akamai scanner.

  2. In Overview, check the Akamai Correlation Policy status.

  3. If the status shows missing environments, click Check again to apply the policy only to those environments.

  4. Wait for the status to change to Applied and confirm all target environments are covered.

If policy application fails, verify your Admin API write permissions and environment access, then retry.

Reviewing Akamai Security Results in the Enhanced Experience

After a successful run, Akamai results appear on existing services:

  • API list views show values in the Security Risk column.

  • API detail pages show Akamai security data in Conformance.

  • Security sections display violation totals, findings, incidents, and endpoint context.

  • The Akamai Security Findings table lists each finding with columns for finding, instance, endpoint, API risk, scan status, and remediation progress.

  • Finding detail views show fields such as status, type, endpoint path, and mapped frameworks.

Interpret Risk Status Levels

The Security Risk column shows the risk level assigned to correlated Akamai findings:

Low

Lower-urgency risk. Review and remediate in your normal security lifecycle.

Medium

Moderate risk. Prioritize remediation after high-risk issues.

High

Elevated risk. Investigate and remediate first.

Critical

Highest-urgency risk. Remediate immediately.

Track Remediation and Scan Status

In the Akamai Security Findings table on the Conformance tab, two columns help you track remediation progress for each finding:

Remediation

Shows how many of the suggested remediation policies are applied on the finding’s instance, as an applied/suggested count (for example, 1/3 remediations). The suggested count reflects the remediation policies recommended for that finding type, and the applied count reflects how many of those policies are currently applied on the API instance. This count is tracked at the instance level, so two findings on different endpoints of the same instance that share a finding type show the same count.

Scan Status

Indicates whether remediation is underway for the finding:

Open

No remediation policy is applied yet for the finding.

Rescan Confirmation

At least one remediation policy is applied on the instance, but the finding still appears in the latest results. Re-run the scanner to confirm whether the finding is resolved.

The Akamai Security Findings table lists only findings that are currently active. When a finding is remediated and a rescan confirms the fix, the finding no longer appears in the table.

Remediate Risks from the API Conformance Tab

Use the API Conformance tab in Portfolio to triage and remediate Akamai findings:

  1. Open the API from the APIs catalog in Portfolio.

  2. Select Conformance and review the Akamai section, including findings and incidents.

  3. Select a finding to open details, such as endpoint, severity, and mapped standards.

  4. Apply recommended remediation policies directly from the finding detail view when available.

  5. Re-run the scanner after remediation to confirm updated findings and risk levels.

If no direct remediation policy is available for a finding, use the finding details to update the API configuration in your gateway or upstream system, then scan again to verify the result.

Troubleshoot Missing Akamai Findings

If a scan completes but results don’t appear:

  • Verify the correlation policy is applied in the same environment as the service instance.

  • Confirm the target service already exists in Portfolio catalogs.

  • Confirm scanner scope and business group match the service location.

  • For traffic forwarded by the Akamai API Security (Omni Gateway) policy, confirm the policy is above the Akamai correlation policy in the policy list.

  • Re-run the scanner after connection or policy changes.

See Also