Securing Registration RESTful API against registering many users

I am developing RESTful APIs with ASP.NET WebAPI for an Android application and there is an option to make a registration through our application. Suppose that our registration endpoint is something like '/api/register/' with some parameters like 'username', 'password' and 'email address'. So this endpoint is likely to be opened not only for Android device, but for everyone.

I mean it is easy to trace all the requests and responses to and from our server, so a bad person may calls this endpoint to start registering many users in our system.

I want to know how I can secure my API?

You can take a number of steps to ensure your API can't be called by a random client. These will be effective for 99.9% of the potential threats, but keep in mind that if someone is very committed and is able to decompile your Android app and man-in-the-middle your app's connection, they can still break your security. (I wouldn't worry about such special cases unless you are trying to protect a really high value target.)

For a basic level of protection:

• Only allow SSL connections, and require "Strict-Transport-Security"
• Use a shared secret that will be validated on the server (e.g. predefined api key, pre-installed client cert, etc.)
• Throttle API calls on the server
• Ensure that your API does not suffer from other common security pitfalls (use the OWASP Checklist: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet)

For increased security, you will need to implement some kind of pre-authentication, similar to the flow I describe here:

• The client asks for an access token from the server.
• The token is unique to the client and generated using the client IP, request time, and the shared secret. It's also short-lived and set to expire soon.
• The client makes the API call using the unique token while it's still alive.
• The server validates the token, confirms it's coming from the authorized client and processes the API call.

This topic is more complex and unfortunately I haven't come across a simple example that I can point you to.