A method may include obtaining input data for an application programming interface (API), and encrypting the input data for the API using a public key of a provider of the API. The method may also include transmitting, to an API management server, an API request that invokes the API, where the API request includes an API call for the API and the encrypted input data. The API request may be in a format such that the API management server is capable of performing API management services based on the API call but unable to decrypt the encrypted input data with the public key.