NOA Labs
🔌 Application Security · Corporate training

API & Microservices Security

Secure open-banking APIs and microservice platforms: OAuth 2.0, mTLS, gateways, BOLA prevention, rate limiting and the OWASP API Security Top 10.

Register your company → See the full outline ↓
$79 per employee · complete course
🗓️
3 weekends
Sat & Sun
⏱️
24 hours
6 live sessions
🎯
Advanced
Level
🧪
6 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

APIs now carry most banking and fintech traffic — and most of the attacks. This programme covers the OWASP API Security Top 10 with hands-on exploitation, then builds a defence-in-depth architecture: OAuth 2.0 and OpenID Connect, API gateways, mutual TLS between services, zero-trust service identity, secrets management and API inventory.

Who it's for: Backend and platform engineers, architects, API product owners and security engineers.

What your team will be able to do

  • ✔Exploit and fix every OWASP API Security Top 10 category
  • ✔Implement OAuth 2.0 / OIDC flows correctly, including PKCE and token validation
  • ✔Secure service-to-service traffic with mTLS and workload identity
  • ✔Design gateway policies: authentication, rate limits, schema validation
  • ✔Maintain an accurate API inventory and retire shadow APIs

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

The API attack surface

Why APIs are the new perimeter.

  • ▸OWASP API Security Top 10 overview
  • ▸Broken object level authorisation (BOLA)
  • ▸Broken object property level authorisation and mass assignment
  • ▸API reconnaissance and documentation leaks
  • ▸Real breaches caused by APIs
🧪 Lab: Exploit BOLA and mass assignment in crAPI 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Authentication: OAuth 2.0 & OpenID Connect

Getting tokens right.

  • ▸OAuth 2.0 grant types and when to use them
  • ▸Authorization code + PKCE
  • ▸Validating JWT access tokens (iss, aud, exp, alg)
  • ▸Refresh token rotation and revocation
  • ▸Financial-grade API (FAPI) profile basics
🧪 Lab: Implement and attack an OAuth flow 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Authorisation & business logic

Function-level authorisation and sensitive business flows.

  • ▸Broken function level authorisation (BFLA)
  • ▸Policy engines and attribute-based access control
  • ▸Protecting sensitive business flows from automation
  • ▸Idempotency and replay protection for payments
  • ▸Testing logic flaws
🧪 Lab: Stop abuse of a payment API 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

API gateways & resource protection

Central policy enforcement at the edge.

  • ▸Gateway responsibilities and anti-patterns
  • ▸Rate limiting and quotas (unrestricted resource consumption)
  • ▸Schema validation and payload limits
  • ▸WAF vs API gateway
  • ▸Security headers and CORS for APIs
🧪 Lab: Configure gateway policies 🔒 Session notes 🔒 Lab guide
Weekend 3
Weekend 3 · Saturday

Service-to-service security

Zero trust inside the platform.

  • ▸Mutual TLS and certificate rotation
  • ▸Workload identity (SPIFFE concepts)
  • ▸Service mesh security features
  • ▸Secrets management with Vault
  • ▸Securing message queues and events
🧪 Lab: Enable mTLS between microservices 🔒 Session notes 🔒 Lab guide
Weekend 3 · Sunday

Inventory, testing & monitoring

Knowing every API you run and watching how it is used.

  • ▸Improper inventory management and shadow APIs
  • ▸API security testing in CI (DAST)
  • ▸Unsafe consumption of third-party APIs
  • ▸API logging and anomaly detection
  • ▸Deprecation and versioning strategy
🧪 Lab: Automate API security testing in CI 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Related application security courses

🛡️ OWASP Top 10 & Secure Coding
3 weekends · $69

Enrol your team in API & Microservices Security

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses