APIs expose your data and business logic directly, and a single authorization flaw can affect every customer. This API security training teaches you how APIs are attacked and how to test and secure them, based on the OWASP API Security Top 10.
Who should attend
- Penetration testers and application security engineers
- Backend and API developers
- DevSecOps and platform engineers
- QA engineers working on API quality
- Testers new to application security can start with our Web Application Penetration Testing Training.
Prerequisites
Participants should understand HTTP requests and responses and be familiar with tools such as Postman or Burp Suite. Basic programming knowledge is helpful for the automation module.
What you will learn
- How REST, GraphQL and other APIs are structured
- Discovering and mapping API endpoints, with and without documentation
- Authentication mechanisms and token weaknesses, including JWT issues
- Broken object level and function level authorization
- Excessive data exposure and mass assignment
- Rate limiting, enumeration and resource consumption
- Injection and input handling in APIs
- Business logic abuse
- Security misconfiguration and unmanaged endpoints
- Automating tests and integrating them into pipelines
- Reporting API findings with clear evidence
Hands-on labs
Participants test intentionally vulnerable REST and GraphQL APIs in a lab, using realistic request and response scenarios, and then automate selected checks for use in CI/CD.
What you receive
- Course materials and lab access
- An API testing checklist based on the OWASP API Security Top 10
- A certificate of attendance
When teams choose this training
API security training is most valuable for organizations whose products depend on APIs: SaaS platforms, fintech and open banking providers, e-commerce, healthcare and any company exposing APIs to mobile apps, partners or customers.
Teams typically take this program when:
- They are launching a public or partner-facing API
- An API penetration test has revealed authorization or authentication flaws, and developers need to understand the root causes
- New developers join backend or platform teams
- They are moving to GraphQL or microservices and need to understand the new attack surface
- Customers or auditors expect evidence of secure development practices
Frequently asked questions
Learn to find API flaws before attackers do
Contact us for dates, pricing and corporate options.
