Transit IT exposes fleet status through Data API builder REST endpoints. Before publishing, what security posture should they apply?

Enforcing HTTPS-only access and role-based authorization before exposing fleet tables through Data API builder REST endpoints is the correct security posture. REST endpoints inherit the identity and transport configuration applied to them: TLS protects credentials and fleet data in transit, while role checks limit which authorized transit principals can read or write each entity. Applying both before publication helps prevent live fleet status data from being exposed through an unsecured endpoint.

Permitting plain HTTP requests from any origin and omitting role checks fails because debugging convenience does not justify exposing operational data without confidentiality or authorization. Mapping anonymous users to db_owner for every REST entity gives unidentified callers database-owner power and violates least privilege. Disabling TLS termination and relying on an obscure URL path fails because obscurity is not access control for municipal operational APIs.

Exam caveat: Data API builder is only as safe as its authentication, authorization, and network configuration. HTTPS without role checks can still permit access under an overly broad policy, while roles without TLS leave tokens exposed in transit. For sensitive operational data, use private networking and Entra roles; anonymous read access should be an explicit product decision, not a default.

Practical check: Require HTTPS, map Entra or built-in roles to least-privilege database users, and deny anonymous db_owner mappings. Test HTTP requests for a redirect or failure, and unauthenticated requests for a 401 or 403. Constrain CORS origins to transit mobile apps, and review each exposed entity’s permissions against its business role before publication.