Capstone Lab — Full API Review

Run YOUR checklist against 127.0.0.1:8819 (or your toy API).

Capstone Lab — Full API Review• Audio Walkthrough

00:00/02:22

Visual · api_capstone_lab

Capstone: checklist × lab evidence. Original Cyberlium.

Prove controls on a host you own — then stop.

Start YOUR API on loopback. Walk the checklist. Capture allow/deny, rate limit, DTO review, gateway health. No stranger targets. Stop the server when done.

1. Bring-up

Bind 127.0.0.1. Confirm RoE.

Health check passes.

Command guide

Try these commands — Bring-up

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

OWASP API Security — https://owasp.org/API-Security/ (capstone checklist) Postman collections — https://learning.postman.com/docs/collections/collections-overview/ jwt.io — https://jwt.io/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq
sudo apt install openssl

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq
choco install openssl

═══ LINUX / macOS ═══

Capstone: auth probe + JSON parse + TLS read on YOUR lab stack

Command — copy this

curl -sS -H "Authorization: Bearer lab-token" http://127.0.0.1:8819/me 2>/dev/null | jq .
curl -sS http://127.0.0.1:8819/items 2>/dev/null | jq 'if type=="array" then length else . end'
echo | openssl s_client -connect example.com:443 2>/dev/null | grep 'Protocol' | head -1
curl -sS -o /dev/null -w "final health %{http_code}
" http://127.0.0.1:8819/health

Primary tools to practice this lesson: curl, jq, openssl. Reference sites: OWASP API Security (https://owasp.org/API-Security/); Postman collections (https://learning.postman.com/docs/collections/collections-overview/); jwt.io (https://jwt.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.