Course
API Design & Security
Build APIs that survive real users and real attackers — resource modeling, versioning, scoped tokens, boundary validation, rate limiting, and the OWASP API Top 10.
Resource Modeling & Versioning
Nouns, IDs, versioning, and pagination — the design decisions you'll live with for years.
- 01Modeling Resources: Nouns, IDs, and Endpoints You Won't RegretResources are nouns, methods are verbs, and public IDs are unguessable — a route table you'll still like in three years.30mOpen
- 02Versioning Without Tears: Breaking Changes, Sunset Headers, MigrationWhat actually breaks clients, when to cut v2, and how to retire v1 without making enemies.25mOpen
- 03Pagination, Filtering, and Sorting Before They Become Attack SurfaceBounded limits, keyset cursors, and allowlisted filters — the query-string features attackers reach for first.30mMembers
Authentication, Scopes & Validation
Tokens that expire, scopes that mean something, and input validation that doesn't trust the client.
- 01Tokens, Scopes, and Expiry: Authentication That Fails ClosedOpaque tokens vs JWTs, refresh rotation, scoped permissions, and why auth middleware must fail closed.30mMembers
- 02Input Validation at the Boundary: Schemas, Mass Assignment, Parser TrapsRuntime schemas, field allowlists, and the parser differentials that turn 'validated' into 'owned'.25mMembers
- 03Authorization Is Not Authentication: Object-Level Checks That Kill IDORBOLA is OWASP API1 for a reason: load-and-authorize patterns, tenant scoping, and the 404-vs-403 tradeoff.25mMembers
Abuse Patterns, OWASP & Honest Docs
Rate limits that hold up, the API Top 10 mapped to controls, and contracts that keep consumers honest.
- 01Rate Limiting and Abuse: Buckets, Identity, and Credential StuffingToken buckets, per-identity counters, and escalation ladders that stop abuse without bricking honest clients.30mPremium
- 02The OWASP API Security Top 10 in PracticeAll ten entries mapped to real bug shapes and real controls — most of them aren't injection.30mPremium
- 03Docs and Contracts That Keep Consumers HonestOpenAPI as the contract, problem+json errors, and examples consumers can copy safely.20mPremium