An API request lane with six server-side checkpoints — identity, authorization, input, data, resources and inventory. A customer's request for their own order passes every check: the token is valid, the caller owns the order, the input matches the schema, only allowed fields are returned, the rate limit holds and the endpoint is documented, ending in 200 OK. The same customer's request for someone else's order passes identity but is stopped at authorization with 403 Forbidden and logged, the number one API risk. An inventory of 142 known endpoints found three undocumented ones and retired them.

CY-MID-017Mid Level · API Security

API Security — The Request Checkpoint

A twenty-hour, highly interactive mid-level course where you secure an API at every request — authenticating the caller, authorizing on the server, validating input, controlling data, limiting resources, and knowing every endpoint. APIs are the dominant attack surface, and broken authorization is the number one risk. Four hands-on activities in every lesson.

20 hours9 chapters45 lessons295 activities9 labs

What you'll learn

Authenticate every request and enforce object-, function-, and property-level authorization on the server.
Validate input and defend against injection, mass assignment, and SSRF.
Control data exposure, limit resources and business-flow abuse, and inventory every API.
Secure API consumption and the ecosystem, and run an API security program.

Price:৳8,000