API Security Checklist
Authn, authz, allowlists, rate limits, gateway, logs — one page.
Visual · api_checklist
Checklist consolidates Topic 13. Original Cyberlium.
If it is not on the checklist, it will be forgotten under pressure.
Assemble a one-page checklist covering Topic 13 controls. Use it in the capstone against YOUR lab — not against random internet APIs.
1. Identity and access
Authn present. Authz per object. JWT verify + claims. OAuth roles understood.
No client-only trust.
Command guide
Try these commands — Identity and access
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP API checklist — https://owasp.org/API-Security/ TLS cheat sheet — https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install openssl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install openssl choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:8819/health | jq '{status: .status // .ok // "unknown"}' 2>/dev/null || curl -sS http://127.0.0.1:8819/health
echo | openssl s_client -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -dates 2>/dev/null || echo 'Document TLS dates for YOUR lab gateway'
curl -sS -o /dev/null -w "capstone probe %{http_code}
" http://127.0.0.1:8819/api/v1/statusPrimary tools to practice this lesson: curl, openssl, jq. Reference sites: OWASP API checklist (https://owasp.org/API-Security/); TLS cheat sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Data and abuse
Input/output allowlists. Rate limits. Injection parameterized. SSRF allowlisted.
GraphQL introspection restricted; depth limited.
3. Edge and ops
Gateway duties clear. Logs redacted. Alerts defined. Loopback labs only in this course.
Written RoE still binds you.
4. What you ship: Topic 13 checklist
One-page control checklist ready for capstone.
5. What you record before the next lesson
Checklist path.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Use the checklist as a hunting guide on strangers.
- Right: Checklist done. Next: capstone lab.
Mission: write the checklist
1) Identity/access section. 2) Data/abuse section. 3) Edge/ops section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Prioritize top five checklist items?”
APPLY: Checklist includes:
APPLY: True or False: Checklist authorizes scanning the internet.
APPLY: GraphQL item example: