I have implemented my product's HTTP(REST) API as a public API. Although my server only allows HTTPS, I don't have any control over the clients. I have vendors implementing clients to my API, and I am wondering if there is any kind of way to protect their end-costumers who will use the vendor's client to communicate with my system - so that the vendor will not be able to use the end-costumer data?
You have the control over what you are serving to the client.
This means that if you don't trust your vendor who provides the client then you face the fact that the vendor can see the data your API is transmitting for the client.
The vendor can do anything with that data.
In order to mitigate that, you can do the following:
- Use a legal contract that covers this concern, you can't control the vendor client
- Encrypt the payload with a key that the only user knows, but that is probably unlikely that the user will have to decrypt/encrypt the traffic, bad user experience.
- Take control over the client or at least audit the code per version
As an API, you can only guarantee how the data and which data is delivered, you can't control over the processing of that data on the client side.