API Security Fundamentals

About this course

This course incorporates the application of artificial intelligence.

A café manager opens a link to her supply order, alters a single digit, and unexpectedly views an order meant for a school kitchen with prices, a delivery address, and a stranger's contact number. She didn’t hack anything; she possessed a valid login. This single digit often serves as the starting point for numerous real API issues, illustrating why the statement, "they have to sign in, so it’s secure," does not conclude a security review.

This course shows you how to conduct an API review like a diligent analyst. You will examine a fictional food-service supplier's customer-order API, utilized by customers, support personnel, administrators, and a partner integration. You’ll assume the role of the analyst tasked with reviewing the API prior to the launch of a new mobile app. The course offers diagrams, design notes, sample messages, and logs, including pause-and-review exercises in each lesson. No coding, hacking, or testing of live systems is involved.

You will learn to:

• Map the API's callers, endpoints, objects, data, and dependencies, identifying trust boundaries where risk levels change.
• Differentiate authentication from object-, property-, and function-level authorization, understanding why a valid login does not equate to permission.
• Navigate a role matrix to determine which roles can access specific orders, fields, and administrative actions.
• Understand why concealing a button or field in an application doesn't qualify as a control, and why the API must enforce all decisions.
• Examine input validation, returned fields, server-side fetching of external resources, and responses from downstream APIs.
• Select size limits, rate limits, quotas, and workflow safeguards to prevent overloading and abuse of legitimate business processes without hindering genuine users.
• Establish requirements for secrets, least privilege, environment separation, safe error messages, and credential-free logs.
• Define the needs for API inventory management, version retirement, security event logging, and incident ownership.
• Document findings including evidence, status, impact, priority, assigned owner, proposed controls, and retesting criteria.
• Generate a scoped, prioritized API security review based on provided evidence, without testing live environments or making unrealistic claims.

The course concludes with a final case where you will review the next iteration of the order API, assess what you discover, formulate a structured review, and contrast it with a provided solution. Risk assessments will reference the OWASP API Security Top 10 (2023), though not as a definitive checklist for safety, maintaining a vendor-neutral perspective throughout.