What types of DDoS attacks are most common against APIs and how can they be mitigated?

Common API DDoS attacks include volumetric attacks (bandwidth floods), application-layer attacks (HTTP floods), and protocol attacks. For volumetric attacks, CDN and traffic scrubbing are crucial. For application-layer attacks, WAFs (Web Application Firewalls) and rate limiting are effective. Protocol attacks often require specialized mitigation techniques like SYN flood protection or TCP/UDP flood mitigation.