I am looking at integrating asp.net web api in to my web application as my external api that other users can build applications against, be it a mobile app etc.
My site is an ecommerce site that displays products and takes payments etc.
I am wondering with regard to security of my web api if it is secure to POST credit card numbers to a REST API end point from an external application, eg mobile app. It is set up over SSL and the calling application is authenticated via OAuth but is there more I should be doing?
As long as you are sending the data through TLS, you should be fine. TLS will encrypt the data that gets sent in the HTTP Request/Response body (as well as a few other things, like the URL path).