API Security - Securing APIs

The author of the post is currently evaluating API security and is seeking advice on implementing API security measures. They have already implemented token-based authentication, the use of non-guessable IDs for secure authentication, rate limiting, as well as monitoring and logging of login attempts. The author believes they are missing input validation and wants to know the best ways to implement it. They also ask if there are any other security controls they might be missing.