there are a lot more things that make APIs "robust". described is only a tip of the iceberg - data/type checks due to de/serialization. Your API may be perfect in terms of type correctness and structure, and contain SQL injection.

There should be also load balancing/HA, rate limiting, authn/authz, injection, all sorts of protections against OWASP top10 type attacks.