How-To: Selectively enable Dapr APIs on the Dapr sidecar

In certain scenarios such as zero trust networks or when exposing the Dapr sidecar to external traffic through a frontend, it’s recommended to only enable the Dapr sidecar APIs that are being used by the app. Doing so reduces the attack surface and helps keep the Dapr APIs scoped to the actual needs of the application.

Dapr allows developers to control which APIs are accessible to the application by setting an API allow list using a Dapr Configuration.

For example, the following configuration enables all APIs for both HTTP and gRPC:

The following example enables the state HTTP API and block all the rest:

The field takes the name of the Dapr API you would like to enable.

See this list of values corresponding to the different Dapr APIs: