API › Module 1 › Lesson 1
What an API Is
An API is a contract with verbs and shapes — practice only on 127.0.0.1:8810.
Visual · api_what_is
API = machine-facing contract. Use 127.0.0.1:8810. Original Cyberlium.
Opening
An API is not “the website.” It is the handshake other programs use — and this course only shakes hands with hosts YOU own.
Application Programming Interface, in Cyberlium wording, is a published contract: paths, methods, headers, and body shapes that a client and a server agree to. Browsers may hide it behind buttons; curl and code talk to it directly. The skill you want is defensive literacy: name the surface, know what “in scope” means, and never treat a stranger’s endpoint as homework. This is ORIGINAL Cyberlium Topic 13 — not an OWASP dump, not a bug-bounty raid kit, not sqlmap-on-random-SaaS. Practical work starts on YOUR teaching API at 127.0.0.1:8810. You will NOT hydra gateways, sqlmap classmates’ APIs, or bind teaching toys to 0.0.0.0. Next: Rules of Engagement and Written Scope.
1. Contract, not a backdoor: name the pieces
A useful API sentence names four things: who may call (client identity), which verb (GET/POST/…), which resource path, and what shape comes back (JSON, status, headers). If you needed a stolen cookie or a guessed password to “discover” it, you left literacy and entered unauthorized access.
MITRE and OWASP give vocabulary for how APIs fail. Cyberlium uses that vocabulary as defense labels on YOUR lab — never as a shopping list against production you do not own. A home-router admin page is a stop, not an “API target.”
Command guide
Try these commands — Contract, not a backdoor: name the pieces
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP API Security Top 10 — https://owasp.org/API-Security/ (risk framing for YOUR lab APIs) HTTP methods — https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods (read before probing)
Optional command
curl manual — https://curl.se/docs/manpage.html (flags for safe local probes)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Probe YOUR teaching API surface on loopback
Command — copy this
curl -sS -m 3 -I http://127.0.0.1:8810/
curl -sS -m 3 -o /dev/null -w "health HTTP %{http_code}
" http://127.0.0.1:8810/health═══ WINDOWS ═══
Command — copy this
Invoke-WebRequest -Uri http://127.0.0.1:8810/ -Method Head | Select-Object StatusCode, Headers
Primary tools to practice this lesson: curl. Reference sites: OWASP API Security Top 10 (https://owasp.org/API-Security/); HTTP methods (https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods); curl manual (https://curl.se/docs/manpage.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Human UI vs machine surface
The same product can have a pretty page and a JSON API. Attackers prefer the machine surface because it is scriptable and often less polished. Defenders must inventory both. Your inventory in this topic is loopback teaching servers on 127.0.0.1:8810–8814, not the café Wi-Fi neighbor’s phone API.
When a blog says “just point Burp at anything interesting,” close the tab. Interesting is not authorization. This course’s interesting dest is YOUR lab on 127.0.0.1.
3. What this topic will never call practice
sqlmap against a public SaaS you do not own. hydra on a login you found with Google. Phishing kits that fake OAuth consent. Mass scraping of stranger APIs “for a portfolio.” Those are crime-adjacent or harassment — not homework.
The deliverable of this lesson is a sentence you can defend: I will only probe APIs I own or that a written lab RoE names, bound to 127.0.0.1. Next lesson writes that as Rules of Engagement.
4. What you ship: a definition that excludes stranger APIs
Write API = machine-facing contract (paths, methods, headers, bodies). Self-lab = 127.0.0.1:8810. Never sqlmap/hydra strangers. Never phishing OAuth kits. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). API vs not-API. Lab = 127.0.0.1:8810. NEVER stranger endpoints, sqlmap, hydra, 0.0.0.0. Path: $HOME/cyberlium-lab/t13-m01-l01-what-api.txt chmod 600. Legal: original Cyberlium — not an API pentest cert.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
sqlmap a random company API “to learn OWASP.” hydra a home router because it answered. Bind a teaching API to 0.0.0.0 on café Wi-Fi.
Right
curl 127.0.0.1:8810. Write the contract definition and the NEVER list. Next: Rules of Engagement and Written Scope.
Mission: define API as a contract you own
1) curl http://127.0.0.1:8810/ (start YOUR teaching server first). 2) Write API vs not-API plus a NEVER list in $HOME/cyberlium-lab. 3) Name 127.0.0.1:8810 as this module’s teaching dest. Never probe stranger APIs. Never sqlmap/hydra.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hint only: what is an API surface vs a website page?” — not how to sqlmap a SaaS.
Knowledge Check
APPLY: curl http://192.168.0.1/ shows a TP-Link “Router Admin” page during an API intro. What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: API practice in this course includes sqlmap against any public JSON endpoint you find.
True or False
Knowledge Check
APPLY: Best one-line definition of an API here?
Multiple choice