This work investigates security vulnerabilities and governance challenges in a GraphQL-based API orchestration layer that integrates multiple systems. This research uses the KAPIO API orchestrator: Knowledge API Orchestrator, which, in addition to acting as a proxy for the APIs connected to it, also has the ability to process data from different endpoints, both in parallel and sequentially. The research delves into security issues by bringing together data from different sources, with varying levels of permission and sensitivity, in a single environment, highlighting risks associated with system-of-systems (SoS) archi tectures, characterized by the union of independent systems to perform new functionalities. The methodology used included a systematic review of the literature on GraphQL security and a static and dynamic code analysis of the original so lution. The work focuses on creating a pilot project capable of maintaining confidentiality through encryption of sensitive data, access control with gran ular permissions per user profile, allowing the selection of specific attributes at each endpoint, and detection of anomalies and cycles. The research concludes with a discussion of possible improvements and future directions, such as the adoption of mitigation techniques for the iden tified security risks, offering a path for the secure implementation of an API orchestrator for the integration of multiple systems in a SoS scenario.