API Security with AI
API authn/authz and abuse cases — AI-assisted review of YOUR lab APIs only
Module 1
API Surface and RoE
What an API is, written scope, loopback-only lab bind — never stranger API hunting.
6 lessons
Module 2
REST Literacy
Methods, status codes, curl/Invoke-WebRequest, JSON contracts on YOUR teaching API.
5 lessons
Module 3
Authentication for APIs
API keys, Bearer tokens, sessions — authn vs authz literacy on YOUR toy server.
5 lessons
Module 4
JWT Pitfalls
Structure, alg=none refusal, verify vs decode, claims hygiene — no forgery kits.
5 lessons
Module 5
OAuth and OIDC Literacy
Roles and flows named; OIDC ID token literacy — no phishing kits.
5 lessons
Module 6
BOLA and IDOR
Object-level authorization; ID swap allow vs deny on YOUR API only.
5 lessons
Module 7
Mass Assignment and Data Exposure
Over-post, verbose JSON, input/output allowlists on YOUR lab.
5 lessons
Module 8
GraphQL Risks
Introspection, batching, field authz — YOUR GraphQL lab only.
5 lessons
Module 9
Rate Limit Injection and SSRF Shapes
429 literacy, injection parameterize, SSRF allowlists — no stranger sqlmap or metadata probes.
5 lessons
Module 10
Gateway Monitoring and Capstone Lab
Gateway vs service duties, logging hygiene, checklist, full API lab + topic quiz.
5 lessons