Detection of abnormal application programming interface (API) sessions including a sequence of API requests using space partitioning data structures

A computer-implemented method includes receiving training data that includes a plurality of API requests from a plurality of client devices. The method includes generating a plurality of permissible API sessions based on the training data. Each of the permissible API sessions is associated with a corresponding client device of the plurality of client devices and includes a sequence of API requests originating from the corresponding client device. The method includes applying a sequence embedding technique to the plurality of permissible API sessions to generate a plurality of embeddings and applying a dimensionality reduction technique to the plurality of embedding to generate a plurality of compact embeddings. The method includes storing each of the compact embeddings in a space partitioning data structure at storage locations within the space partitioning data structure that are determined based on similarities between the compact embeddings.