Are there any WAF for APIs that detect anomalous traffic and block bot-driven abuse in real time?

Yes. There are WAF/API security products that do more than classic signature-based filtering—they also do real-time bot detection, anomaly detection, and abuse mitigation for APIs.

What to look for

For API protection against bot-driven abuse, you typically want a combination of:

• API-aware WAF: understands JSON, GraphQL, REST, OpenAPI schemas
• Bot management: detects automated clients, headless browsers, scripts, credential stuffing, scraping, enumeration
• Anomaly detection / behavioral analytics: flags unusual request rates, geolocation shifts, fingerprint changes, sequence anomalies
• Rate limiting / quotas: per IP, user, token, device, ASN, or route
• Adaptive challenges / blocking: blocks or challenges suspicious traffic in real time
• Threat intelligence + reputation: known bad IPs, proxies, TOR, datacenter networks
• Runtime/API abuse controls: detects token abuse, auth abuse, excessive data harvesting, replay attacks

Common vendors/products in this space

A few well-known options:

• Cloudflare WAF + Bot Management + API Shield
• Akamai API Security / Bot Manager
• Imperva Advanced Bot Protection + API Security
• F5 Distributed Cloud WAAP
• Fastly Next-Gen WAF + bot controls
• Radware Bot Manager / API Protection
• DataDome (strong on bot management, can protect API endpoints too)
• Salt Security (more API discovery/anomaly detection than inline blocking)
• Noname Security (API security with behavioral anomaly detection)
• Mend.io / Wallarm / Cequence / Traceable AI (varies by focus, but many include API anomaly detection and abuse detection)

Important caveat

A traditional WAF alone often isn’t enough for API abuse. For real-time bot-driven abuse, you usually need WAAP (Web Application and API Protection) or a dedicated API security + bot management solution, because many attacks look “valid” at the HTTP layer but are abusive at the behavioral layer.

If you’re evaluating solutions, ask whether they can:

• Inspect authenticated API traffic and not just anonymous web traffic
• Detect headless browsers, rotating proxies, and low-and-slow automation
• Enforce per-endpoint policies and schema validation
• Protect mobile APIs and support app attestation/device fingerprinting
• Work inline with low latency
• Provide real-time mitigation, not just alerts

If you want, I can also give you:

1. a shortlist by cloud/on-prem/SaaS, or
2. a comparison table focused on API anomaly detection and bot blocking.