Rina, API security lead at Junction, works the eight-arc API defense loop: inventory, authentication, authorization, input validation, rate limits, data exposure, logging and lifecycle, after a discovery scan found 97 APIs where the team believed there were 40. A curl probe against Junction's own test API shows one customer reading another's order, fixed so it now returns 403; responses are cut to an allow-list so the password hash, fraud score and support notes are no longer returned; an account walking through 500 order IDs in three minutes now raises an alert, and a retired API is actually switched off.

CY-MID-026Mid Level · API Security

API Security Engineering — The API Defense Loop

A hands-on mid-level course that secures the REST and GraphQL APIs you build and operate. Work the API defense loop - eight arcs: Inventory, Authentication, Authorization, Input Validation, Rate Limiting, Data Exposure, Logging & Monitoring, and Lifecycle - closing the OWASP API Security Top 10 with per-object authorization, validated JWTs, schema validation, and quotas. Every probe is against your own test API and paired with the fix. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Inventory every API and version so none is left unprotected.
Enforce strong authentication and per-object, per-function authorization.
Validate input, limit resource use, and stop excessive data exposure.
Log, monitor, and govern APIs across a secure lifecycle.

Price:৳8,000