- Using container orchestration such as Kubernetes
- Enable centralised exception and/or request logging
- Use async actions
- Rate limiting
- Message queues
- Force the API to run over SSL
- Implement hashing of the password field
- Implement authentication and authorisation to control access