Brute force protection for an API endpoint (no login page)?

Hello Mohamed.

Actually, you have a default "Brute Force Attack Prevention" profile which applies to all the URLs not manually defined.

"You can add default brute force protection when creating a security policy using the Deployment wizard. If you do, the policy simply needs to know for which login pages to enforce brute force protection. The system creates a default brute force configuration that applies to all defined login URLs that are not associated with any other brute force configuration."

REF - https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-12-1-0/6.html

See this path ->

Security > Application Security > Anomaly Detection > Brute Force Attack Prevention

KR,

Dario.