Practical DevSecOps Logo
+1 (415) 800 4768

Certified API Security ProfessionalTM

Develop comprehensive API security expertise to protect critical systems. Implement advanced authentication, authorization, OWASP Top 10, OAuth, JWT, RBAC, input validation, rate limiting, CI/CD pipeline integration and Implement defense patterns using gateways. Prevent 94% of common API attacks with proven methods.

Enroll Now
Watch course overview

Over 5,000+
Learners Certified

Video thumbnail

Monitor iconSelf-paced learning

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Monitor iconSelf-paced learning mode

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Monitor iconSelf-paced learning mode

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Trusted by top companies across industries, empowering thousands of professionals worldwide. Join the ranks of security leaders

API Security Training Prerequisites

  1. Course participants should have a basic understanding of Linux Commands and
    OWASP Top 10.
  2. Basic knowledge of application development is preferred but is not necessary.

Chapter 1: Introduction to API Security

  1. Introduction to Application Programming Interface
    1. What is an API?
    2. Need for an API
    3. Why Should You Secure Your APIs?
    4. APIs vs. Web Applications
  2. Understanding API Architecture
    1. Overview of the HTTP protocol
      1. Anatomy of a HTTP Request
      2. Anatomy of a HTTP Response
      3. HTTP Response Codes and Its Significance
      4. Stateless and Stateful Requests
    2. Overview of API architecture
      1. API Protocols
      2. API Data formats
      3. Different Types of API
    3. Simple Architecture
      1. How Are APIs Typically Deployed?
    4. Complex Architecture
  3. Strategies To Secure APIs
    1. Threat Modeling of APIs
    2. Traditional VAPT vs API VAPT
  4. API Defenses
    1. Input Validation
    2. Identification
    3. Authentication
    4. Authorization
    5. Data Encryption
    6. Transport Security
    7. Error Handling and Logging
    8. Supply Chain Security
  5. Hands-on Exercises:
    1. Understanding The Lab Setup
    2. Working With Linux Command(s)
    3. Working With Command Outputs
    4. Working With Exit Code
    5. Hosting Files Using HTTP Server

Chapter 2: API Security Tools of the trade

  1. The Moving Parts in an API
    1. API Gateway
    2. Load Balancer/Reverse Proxy
    3. Message Queues
  2. Critical Toolchain for API Development
    1. Source Code Management
    2. CI/CD Tools
    3. Artifact Management
    4. Cloud Platform
    5. Infrastructure as Code
    6. Monitoring and Logging Tools
    7. Collaboration Tools
  3. Containerization
  4. Ability To Talk to an API
    1. cURL (curl)
    2. Postman
    3. OpenAPI (Swagger)
    4. Python
    5. An MITM Proxy
    1. Hands-on Exercises:
      1. Understanding an API Language (Endpoints, Verbs, and State)
      2. Understanding cURL Command
      3. Performing CRUD Operations Using API
      4. Setup the Burp Suite for API Security Testing
      5. Understanding APIs Using OpenAPI Specifications
      6. Performing Reconnaissance on an API
      7. Path And Directory Discovery Using FFUF
      8. Enumerating User Accounts From an AP
    CASP-image

    What you’ll learn from the Certified API Security Professional Course?

    API Security Testing identifies critical vulnerabilities. You will master OWASP tools to detect injection attacks, prevent broken authentication, and block API threats in real-time.

    API Authentication Security stops data breaches. You will implement JWT tokens, OAuth 2.0 workflows, and API key validation to prevent unauthorized access and credential theft.

    API Security Assessment protects REST, GraphQL, and SOAP. You will discover shadow APIs, identify OWASP API Top 10 vulnerabilities, and verify controls across gateways.

    API Data Protection safeguards sensitive information. You will apply input validation, secure parameter handling, and encryption techniques to prevent data leakage and theft.

    API Authorization Framework prevents BOLA attacks. You will implement role-based access controls, object-level authorization, and proper API permission scoping.

    API Security Automation enhances CI/CD pipelines. You will deploy security scanners, implement security-as-code, and enforce API standards enterprise-wide.

    Enroll Now

    Chapter 3: Authentication Attacks and Defenses

    1. Overview of API Authentication
    2. Types of Authentication
      1. No Authentication (Public APIs)
      2. HTTP Basic Authentication
      3. API Token Authentication
      4. OIDC Authentication
      5. JSON Web Tokens (JWTs)
      6. SAML Tokens
      7. Mutual TLS
    3. Authentication Attacks
      1. Brute Force
      2. Weak Password Storage
      3. Password Reset Workflows
      4. Account Lockouts
      5. Insecure OpenID Connect Configuration
      6. Insecure JWTs Validation
    4. Authentication Defenses
      1. Secure Authentication Workflows
      2. Strong Password and Key Validation
      3. Multi-Factor Authentication
      4. Securely Storing the Tokens
        1. Cookies 
        2. Local Storage and Session Storage
        3. Token Storage and XSS
      5. Rate Limiting
      6. CAPTCHA
      2. Hands-on Exercises:
        1. Talking To An API Using OAuth and JWT
        2. Talking To An API Using HTTP Basic and API Keys
        3. Exploiting Broken Authentication With SQL Injection
        4. Exploiting Broken Authentication With Weak Passwords
        5. Cracking Weak Password Hashes With Dictionaries
        6. Cracking Weak Password Hashes With Bruteforce And Combinations
        7. Abusing JWT Tokens

      Chapter 4: Authorization Attacks and Defenses

      1. Overview of API Authorization
      2. Types of Authorization
        1. No Authorization
        2. Role-Based Access Control (RBAC)
        3. Discretionary Access Control (DAC)
        4. ​​Attribute-Based Access Control (ABAC)
        5. Relationship-Based Access Control (ReBAC)
      3. Authorization Attacks
        1. Misconfigured Permissions
        2. Broken Object Level Authorization
        3. Broken Function Level Authorization
        4. Horizontal Privilege Escalation
        5. Vertical Privilege Escalation
      4. Authorization Defenses
        1. Defending Object & Function Level Access
        2. Attribute-Based Access Control (ABAC) with Roles, and Relations
        3. Decoupling Authorization Decisions With Policy As Code
      5. Authorizing with OAuth Framework
        1. OAuth Specification
        2. Different Authorization Workflows
        3. Insecure OAuth Configurations
        4. OAuth 2.0 vs OAuth 2.1
        5. Different Types of Tokens
          1. Access Token
          2. Refresh Token
          3. ID Token
      6. Hands-On Exercises:
        1. Forging JWT Tokens For Privilege Escalation
        2. Finding Another Users Location Using BOLA

      Chapter 5: Input validation Threats and Defenses

      1. Introduction to Input Validation
        1. Input Validation
        2. Input Sanitization
      2. Injection Vulnerabilities
        1. Cross-Site Scripting (XSS)
        2. SQL Injection
        3. ORM Injection
        4. NoSQL Injection
        5. Server Side Request Forgery
        6. Deserialization Issues
        7. Mass Assignment Issues
      3. Fuzzing
        1. Fuzzing 101
        2. Fuzzing vs Brute Forcing
        3. Fuzzing APIs Using Open Source and Commercial Tools
          1. Burp Suite Intruder
          2. OWASP ZAP Fuzzer
          3. Wfuzz
          4. FFUF
      4. Injection Defenses
        1. Implementing Input Validation
        2. Client-Side vs. Server-Side Validation
        3. Whitelisting & Blacklisting
        4. Implementing Input Sanitization
        5. Validating With Regular Expressions
        6. Output Encoding
          1. HTML Encoding
          2. HTML Attribute Encoding
          3. Javascript Encoding
          4. CSS Encoding
        7. Prepared Statements
        8. Content Security Policy
        9. Trusted Types
      5. Hands-On Exercises:
        1. Getting Free Coupons Without Knowing Coupon Code
        2. Exploiting Mass Assignment Vulnerabilities
        3. Insecure Deserialization To Remote Code Execution
        4. Preventing Insecure Deserialization In Java
        5. Post Exploitation In APIs Through Reverse Shells
        6. Automated SQL Injection Using SQLMAP
        7. Learning To Validate Input With Regular Expressions
        8. Preventing DOM XSS With Trusted Types
        9. Attacking GraphQL APIs

      Chapter 6: Other API Security Threats

      1. Introduction to OWASP API Top 10
        1. Broken Object Level Authorization
        2. Broken Authentication
        3. Excessive Data Exposure
        4. Lack of Resources and Rate Limiting
        5. Broken Function Level Authorization
        6. Mass Assignment
        7. Security Misconfigurations
        8. Injection
        9. Improper Asset Management
        10. Insufficient Logging and Monitoring
        11. Broken Object Property Level Authorization
        12. Unrestricted Resource Consumption
        13. Unrestricted Access to Sensitive Business Flows
        14. Server Side Request Forgery
        15. Improper Inventory Management
        16. Unsafe Consumption of APIs
      2. Attacking Caching Layers (Memcache, Proxies, etc.,)
      3. Attacking GraphQL APIs
      4. Attacking SOAP APIs
      5. Abusing Micro-services, and REST APIs
      6. Post Exploitation in the API World
      7. Hands-On Exercises:
        1. Privilege Escalation With Cross Site Scripting
        2. Abusing CORS Misconfigurations

      Chapter 7: Other API Security Defenses

      1. GraphQL API Security Best Practices
      2. SOAP API Security Best Practices
      3. REST API Security Best Practices
      4. Data Security
        1. Encoding and Decoding
        2. Escaping
        3. Hashing
        4. Encryption and Decryption
      5. Securing Data at Rest Using Encryption
        1. Storing Credentials for Service-to-Service Communication
        2. Password Storage and Its Considerations
        3. Picking a Secure Algorithm
      6. Securing Data in Transit Using TLS
      7. Rate Limiting Best Practices
      8. Security Headers
        1. X-XSS-Protection
        2. HTTP Strict Transport Security (HSTS)
        3. Cache-Control
        4. X-Frame-Options
          1. X-Frame-Options vs frame-ancestors
        5. Content Security Policy
          1. Implementing CSP at Scale
          2. Common Misconfigurations While Using CSP
        6. Cross-Origin Resource Sharing (CORS)
          1. Cookie Based Implementations
          2. Token Based Implementations
      9. Hands-on Exercises:
        1. Adding Content Security Policy To Mitigate Cross Site Scripting
        2. Implementing Rate Limiting With API Gateway
        3. Securing HTTP Headers using Kong Gateway
        4. Implementing Rate Limiting using API Key

      Chapter 8: Implementing API Security Mechanisms

      1. API Security Design Best Practices
      2. Authentication Implementation
      3. Authorization Implementation
        1. Designing API Permissions
        2. Designing OAuth Scopes
      4. Rate-Limiting Implementation and Best Practices at Different Stages
        1. Reverse Proxy
        2. Load Balancer
        3. API Gateways and WAFs
        4. Request Throttling
      5. Securely Store Secrets Using Hashicorp Vault
      6. Data Security Implementation
      7. Using Transport Layer Security (TLS)
      8. Implementing Sufficient Logging & Monitoring
        1. Secure Logging Implementation
        2. Logging Using Syslog Format
        3. Using ELK To Capture the Log Data
      9. Hands-on Exercises:
        1. Using HashiCorp Vault To Create and Consume Secrets Safely
        2. Monitoring Docker Containers Using Grafana

      Chapter 9: API Security, the DevSecOps Way

      1. OWASP ASVS Framework
        1. Understanding OWASP ASVS
        2. Using ASVS To Secure Applications and APIs
        3. Creating Checklists With OWASP ASVS
      2. Automated Vulnerability Discovery
      3. Finding Insecure Dependencies Using Software Component Analysis
      4. Finding Vulnerabilities in Code Using Static Application Security Testing
      5. Automating API Attacks Using Dynamic Application Security Testing
      6. Addressing API Security Issues at Scale
      7. Hands-on Exercises:
        1. Creating a Simple CI/CD Pipeline
        2. Deploying a Microservice(s) Using Continuous Deployment
        3. Embedding Software Composition Analysis Into CI/CD Pipeline
        4. Embedding Static Application Security Testing Into CI/CD Pipeline
        5. Embedding Dynamic Application Security Testing Into CI/CD Pipeline

      API Security Certification Process

      1. After completing the course, you can schedule the CASP exam on your preferred date.
      2. The process of achieving Practical DevSecOps CASP Certification can be found on the exam and certification page.

        Benefits of enrolling in the

        Practical DevSecOps Courses

        Master today’s security challenges with our updated curriculum and hands-on labs, preparing you for real-world threats.

        Browser-based lab

        Access all tools and exercises directly in your browser. Enjoy a practical, hassle-free learning experience - no downloads or installations needed!

        Enroll now

        Explore commands with our new AI-Powered 'Explain to me' feature

        Gain detailed insights into any command with our AI-powered feature, designed to enhance your understanding and accelerate your learning.

        Enroll now

        Master cutting-edge tools

        Enhance your security skills through hands-on experience with the latest industry tools in our labs. Get equipped for real-world applications and stay ahead of industry changes.

        Enroll now

        Frequently asked questions (FAQs)

        What are the prerequisites required before enrolling in the Certified API Security Professional Course?

        You should have a basic understanding of Linux Commands and OWASP Top 10. It’s good to have basic knowledge upon Application development.

        What’s included in the Certified API Security Professional course package?

        You will get access to the videos for 3 years, 60 days of browser-based labs, a PDF manual, 24/7 student support, and one exam attempt.

        Do the labs for the Certified API Security Professional Course start immediately after enrollment?

        No, the course does not begin automatically upon enrollment. Upon completion of the purchase, students will have the opportunity to select their preferred commencement date. The course will be provided on the chosen start date.

        Does the Certified API Security Professional Course come with CPE points?

        Yes, the API security course gives you 36 CPE points after your course completion.

        What is the exam format for the Certified API Security Professional Course?

        The exam is a task-oriented examination in which you will be required to solve 5 challenges within a timeframe of 6 hours, with an additional 24 hours to complete the report and submit it for evaluation. For more information, visit this link.

        Should I go to an exam center, or is the exam online?

        Yes, the exam is done online. You are welcome to take the exam at the convenience of your home or office.

        How long is the Certified API Security Professional certification valid?

        Our API Security Professional Certification is a lifetime credential, so you will not need to worry about renewing it. Once you get it, it will last for the rest of your career.

        Why Certified API Security Professional Course from Practical DevSecOps?

        Develop comprehensive API security expertise through our industry-leading certification program. This course takes you from foundational concepts to advanced implementation strategies across the entire API security landscape.

        You’ll gain hands-on experience with essential security tools including cURL, Postman, Burp Suite, and HashiCorp Vault while mastering critical defense mechanisms against the OWASP API Top 10 vulnerabilities. The curriculum covers:

        • Authentication systems (OAuth, JWT, OIDC) and exploiting/defending authentication workflows
        • Authorization frameworks (RBAC, ABAC, ReBAC) and preventing privilege escalation
        • Input validation techniques to protect against injection attacks, XSS, and SSRF
        • Practical implementation of security headers, CSP, rate limiting, and encryption
        • DevSecOps integration with CI/CD pipelines, SAST, DAST, and vulnerability management

        According to recent industry surveys, 89% of employers now prioritize API security skills, with organizations experiencing API-related breaches reporting an average $1.2M in damages per incident. Our certification prepares you to protect critical data flows and infrastructure against the sophisticated attack techniques used in 95% of modern API exploitations.

        Whether you’re a developer, security professional, or architect, this course provides the comprehensive security foundation needed to design, build, and maintain secure API ecosystems in today’s threat landscape.

        Hear from our learners

        Explore the global impact of our API Security Professional Course through our learners’ testimonials.

        After two months of studying and a grueling 12-hour exam last Saturday, I'm happy to share I can now call myself a Certified DevSecOps Professional!

        Would recommend the course to anyone that wants to really get hands-on and technical with tooling such as SCA, SAST, DAST, IaC and CaC.

        Danilo Verhaert

        Cyber Security Technology Specialist at Microsoft

        I received good news over the Thanksgiving week: I passed my Certified Container Security Expert exam! This is exam is provided by the Practical DevSecOps training group, which I highly recommend for hands-on skills in the DevSecOps field. The practical labs and 6 hour exam covers a number of security strategies and tools, including: Harbor, Cosign, Trivy, Grype, Snyk, Dockle, Seccomp and many more! The training is FIRST CLASS!

        Jason Lutz, MPA

        AWS Sr. Technical Account Manger (Cloud Security)...

        I am happy to share that I have lately gained the Practical DevSecOps Professional Certification (CDP).

        Thanks to the Practical DevSecOps team, for both excellent material and a lot of great practical labs.

        The certification finished off with a challenging 12 hours practical exam and extensive report writing.

        Stephan Kaas Johansen

        CTO at WinLas - Leading development of next genera...

        I'm excited to share that I have successfully obtained the CCNSE certification!

        This accomplishment has provided me with advanced abilities to effectively secure microservices, containers and Kubernetes environments.

        I now possess comprehensive expertise in handling attacks, implementing defenses, and ensuring compliance within these complex systems.

        I would like to give big thanks to the very responsive team at Practical DevSecOps.

        Ahmad Tabbara

        Cybersecurity Engineer | Penetration Tester | Cyberse...

        The course in general was a great experience, really well structured and quite intense. The teacher was really happy to cover and answer all of our question and make sure we understand the connection between various DevOps processes.

        Spyridon Manglis

        ING

        Oops I did it again 🙂

        I'm happy to share that I pass the Certified Container Security Expert course and exam. Many thanks to the Practical DevSecOps Team for an interesting course

        Batel Zohar Tova

        Developer Advocate at JFrog

        After two months of studying and a grueling 12-hour Practical exam, I'm happy to share that I can now call myself a Certified DevSecOps Professional!

        Warmly recommend this excellent course for technical architects, or engineers who want to gain hands-on skills on how to embed security across modern SDLC.

        The labs covered running below mentioned security tools using Docker and building E2E DevOps pipeline with integrated security automation using GitLab, Jenkins, CircleCI, and GitHub Actions.

        SCA, SAST, DAST, Infra as Code/hardening (IaC), Compliance as Code(CaC), Vulnerability mgmt

        Thanks Practical DevSecOps

        Ahmed AlaaEldin

        Sr. Application Security Consultant @ AppSec...

        This was a great course with practical training for how to embed automated security scanning into a CI/CD pipeline, plus hardening and compliance checks using an everything-as-code approach. Finishing off with a challenging 12 hour practical exam and extensive report writing requirement and assessment to gain the Certified DevSecOps Professional (CDP) certificate. Thanks to Mohammed A. Imran and Raj Shekar of Practical DevSecOps.

        Paul Cullum

        Security Operations Lead @Balyasny...

        After very challenging 12-hours hands-on exam and preparing extensive exam report I am now Certified DevSecOps Professional (CDP)!

        The quality of the course material was surprisingly good and the lab environment is better than any other that I've come across. And in the AppSec field, I have seen quite a few of them. If you want to learn about application security, CI/CD pipelines, Docker, IaC, CaC, SAST, DAST, SCA and these other crazy but very cool acronyms and buzzwords, you would be very wise to join this course.

        Tuomas Tiensuu

        Chief Information Security Officer @ JAY Solutions...

        Whoa! After completing 139 lab exercises and intensive 12 hour exam in 1,5 months, I am finally a Certified DevSecOps Professional too. 🎉

        Warmly recommend this excellent course for technical Product Owners, architects or engineers who want to gain hands-on skills on how to embed security across modern SDLC.

        The labs covered running below mentioned security tools using Docker and building E2E DevOps pipeline with integrated security automation using GitLab, Jenkins, CircleCI and GitHub Actions.

        SCA: Safety, pip-audit, RetireJS, dependency-check, Snyk, npm audit, auditjs, bundler-audit SAST: Trufflehog, detect-secrets, Bandit, Gosec, semgrep, hadolint, FindSecBugs, njsscan, pylint, Brakeman, SonarQube DAST: nikto, nmap, SSLyze, ZAP, Dastardly Infra as Code/hardening: Ansible, AnsibleVault, TFLint, Checkov, Terrascan, tfsec, Snyk Compliance as Code: Inspec for CIS Benchmark, ASVS, Docker compliance Vulnerability mgmt using DefectDojo

        Vilma Blomberg

        Cybersecurity

        I am happy to share that I have lately gained the Practical DevSecOps Professional Certification (CDP).

        Thanks to the Practical DevSecOps team, for both excellent material and a lot of great practical labs.

        The certification finished off with a challenging 12 hours practical exam and extensive report writing.

        Tu Ngo Van

        CyberSecurity Enthusiast

        I recently took the Certified DevSecOps Professional (CDP) certification from Practical DevSecOps. I would recommend the course for anybody that is interested in DevSecOps. The course material was well-written and presented. The labs were very helpful for real-world applications, and the test was a fun challenge.

        Jamy Casteel

        GSE #316 | MSISE | MBA | CISSP | SANS...

        Another awesome certificate to the collection 🙂 Thanks Practical DevSecOps for very valuable course and certificate. Can't wait to attend another one of your courses!

        Bartlomiej Czesak

        4Code

        Another awesome certificate to the collection 🙂 Thanks Practical DevSecOps for very valuable course and certificate. Can't wait to attend another one of your courses!

        Bartlomiej Czesak

        4Code

        Read more reviews

        Future-Proof Your Career with APIsec Training

        Unlock your potential with API Security Training! Our Certified API Security Professional Course equips you with job-ready skills. Conquer the 6-hour exam with confidence and open doors to exciting opportunities and challenges.

        Train my team
        Enroll now

        Unmatched practical focus

        70% hands-on labs for Master real-world scenario’s.

        Expert-crafted curriculum

        Get real-world insights from the experienced Security Experts.

        Practical exam

        Take a 6-hour examination to show what you have learned.

        24/7 expert support

        Unbeatable guidance throughout your learning journey.