API Security

Securing the interfaces your systems expose — and proving each control to an auditor

Phase 5 protected the network; this phase protects the APIs that run on top of it. APIs are where modern breaches happen: the data is no longer behind a human login but behind a programmatic interface that a script can hit a million times. This phase covers how APIs authenticate and authorize callers (API keys, JWT, OAuth2/OIDC, mTLS, and the RBAC/ABAC/ReBAC models behind them), the OWASP API Security Top 10 (2023) as the shared vocabulary auditors and pentesters use, and the gateway layer that enforces it all — rate limiting, key lifecycle, and request validation. The throughline is the same as every phase: translate an "secure the API" control requirement into a specific technical configuration and the exportable evidence that proves it operates.

~4 hours

4 modules

175 points

Module 6.2

API Authentication and Authorization

How an API proves who is calling (authentication) and decides what that caller may do (authorization). Covers the authentication mechanisms — API keys, JWT, OAuth2/OIDC, and mTLS — and the authorization models that sit on top of them: RBAC, ABAC, and ReBAC. Each is framed by the control requirement it satisfies and the evidence that proves it. You then choose the right auth pattern for eight real API scenarios.

45 min

0 / 2

Module 6.3

OWASP API Security Top 10 (2023)

The OWASP API Security Top 10 is the shared vocabulary auditors, pentesters, and engineers use to talk about API risk. This module walks all ten categories — from Broken Object Level Authorization (BOLA) to Unsafe Consumption of APIs — with a concrete example of each and the evidence that proves it is mitigated. You then find seeded flaws in a mock API specification and map each to its Top 10 category.

60 min

0 / 3

Module 6.4

API Gateways, Rate Limiting, and Key Lifecycle

The gateway is where API security controls are enforced in one place: authentication offload, rate limiting, request validation, and logging. This module covers what an API gateway is responsible for, the rate-limiting algorithms that protect against abuse and runaway cost, and the full API-key lifecycle — issue, scope, rotate, revoke — plus the evidence each step produces. You then design rate limits and key management for five API tiers.

40 min

0 / 2

Module 6.5

Phase 6 Capstone: API Security Review

Bring together everything from this phase. You are handed a fictional company's API surface — endpoints, an OpenAPI excerpt, and its current auth setup — and must produce a single API security review: identify the authentication and authorization model and its gaps, find the OWASP Top 10 exposures, specify the gateway, rate-limiting, and key-lifecycle controls, and list the evidence artifacts that would prove each control to an auditor.

60 min

0 / 1