Secure REST API and Mobile Application Integration for Distributed Systems: An Integration-Integrity Architecture

Abstract

Enterprises expose core business functionality to mobile applications through REST APIs built on the architectural principles Fielding and Taylor's (2002) foundational analysis of the modern Web architecture established, principles that assume a well-behaved client but do not by themselves defend an API against a client that is compromised, careless, or simply operating over an unreliable mobile network. Three specific, well-documented problems complicate REST API integration with mobile applications beyond what the REST architectural style alone resolves. First, an API that trusts the structure and content of what a client sends it is vulnerable to injection and malformed-input attacks of exactly the kind the software security literature has documented and defended against for two decades (Halfond, Orso, & Manolios, 2006), a risk compounded when the client itself may already be compromised, as the mobile application security literature documents is common (Sadeghi, Bagheri, Garcia, & Malek, 2017). Second, a mobile client's requests do not arrive at a steady, predictable rate, and an API without adaptive throttling is exposed to both deliberate abuse and the bursty retry patterns the distributed systems traffic-management literature documents as a measurable operational risk (Saleh Sedghpour, Klein, & Tordsson, 2022). Third, and most distinctively for mobile integration, an unreliable mobile network causes clients to retry requests whose first attempt may have already succeeded, and an API that is not built to handle this safely risks the double-processing problem the foundational distributed-systems literature on consistency and distributed transactions documents as a structural, not incidental, consequence of operating across an unreliable network (Gilbert & Lynch, 2002; Helland, 2017). This paper proposes BASTION (Boundary-Aware Schema, Throttling, and Idempotent Operations Network), an architecture in which an API contract validation layer, an adaptive throttling and abuse resistance layer, and an idempotent distributed consistency layer are coordinated by an integration integrity controller that preserves a single, consistent view of API integrity across request validation, traffic shaping, and retry-safe processing. Following a design-science research approach, BASTION is illustrated, not empirically validated, through a comparative capability table, an illustrative case scenario, and two illustrative figures, with every quantitative value explicitly labeled as an illustrative estimate rather than measured production data. The paper situates BASTION against the literature on REST architectural principles, SQL injection defense, mobile application security, OAuth authorization security, service mesh traffic management, distributed consistency, conflict-free replication, and zero trust architecture.