An API is the interface one system uses to request data or actions from another, such as a camera platform passing events to an access control system. API security covers how those calls are authenticated, what each integration may read or change, and how the keys that authorize them are protected.
Integrations are usually the moment two security systems stop being separate products and start being one attack surface. The API is the part that has to be trusted.
Tokens, keys and least privilege
Most APIs authenticate with a key or token rather than a password. That secret should belong to one integration, be limited to the operations it actually needs, and be rotated when staff change or a service is retired. A shared account hides who changed what.
Questions before an integration
Ask what data leaves the building, over which network path, and who can see it at the other end. Check how the vendor handles firmware and API versions, and whether the connection can be logged. An integration that cannot be audited is hard to defend after an incident.
Related:Commercial securityGlossary: VMS