Although API requests to REDCap are done using SSL (HTTPS), which means that the traffic to and from the REDCap server is encrypted, there is still more that can be done to ensure the highest level of security when using the API. This is especially important if you are moving sensitive data into or out of REDCap. One thing that is *highly* recommended is for your API script/program (i.e. the thing making the request to the REDCap API) to validate the SSL certificate of the REDCap web server when it makes the API request.

Web servers have SSL certificates so that their identity can be validated and thus trusted, after which secure, encrypted communication can take place with the server. The reason it is important to validate the server's SSL certificate is because it is possible (although extremely rare) to be the victim of a Man in the Middle Attack even when your web traffic is secure over SSL/HTTPS. A Man in the Middle (MiM) attack can be performed by a hacker who impersonates the REDCap web server using a fake/invalid SSL certificate. In this way, it is possible for your API script to think that the hacker is really the REDCap server and thus unwittingly send your request not to REDCap but to the hacker, in which he/she can actually see the contents of your request, including your API token, and then use your token to impersontate you to make API requests to REDCap in the future as if they were you.

Preventing MiM attacks is pretty simple. Essentially all you need to do is to force your API script to validate the SSL certificate of the REDCap server. REDCap's SSL certificate will always be valid, but the hacker's fake certificate can never be determined to be valid if you attempt to validate it. In many programs or programming languages that can make API requests, validating an SSL certificate is often as easy as setting a flag. For example, cURL is popularly used by many API scripts in programming languages such as PHP, R, SAS, and many more in order to make the web request to REDCap. So if your API script is utilizing cURL, all you need to do is modify your script so that it sets the cURL option named CURLOPT_SSL_VERIFYPEER to have a value of TRUE. Once done, your API script will attempt to make the API request to REDCap *only* if it can validate REDCap's SSL certificate. Thus by adding the SSL certificate check, you have completely prevented the possibility of MiM attacks and are using the most secure form of communication with the REDCap API. If you are not using cURL, there are plenty of other examples on the web for how to validate an SSL certificate in different programming languages. Such examples can be found simply by Googling the name of your programming language + 'verify ssl certificate' (e.g., 'Java verify ssl certificate'), which should provide you with many helpful results.

Please remember that while REDCap itself has many security layers to help protect you and to ensure the highest level of security and data integrity, it is *your* responsibility to ensure that you are using the most secure methods and best practices when using the REDCap API.