Application Programming Interface (API) Security Testing: BOLA, IDOR, Auth and Data Exposure

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

A practical course in testing APIs the way Safeguard's API Security engine tests them: import an OpenAPI or Postman collection, carry an authenticated session across every request, and hunt the OWASP API Top 10 from broken object and function level authorization through mass assignment and excessive data exposure. You will learn how to evidence a finding such as an IDOR without damaging data, and how to run the whole practice continuously instead of once a year.

What you'll learn

Foundations of API Security Testing

The API Attack Surface and the OWASP API Top 10
Importing OpenAPI and Postman Collections into Safeguard
Authenticated Session Handling for API Scans

Broken Object and Function Level Authorization

BOLA: Object Level Authorization Failures
Broken Function Level Authorization and Privilege Escalation
Evidencing an IDOR Without Damaging Data

Authentication and Data Exposure

Broken Authentication in APIs: Tokens, Keys and Sessions
Excessive Data Exposure and Over-fetching
Mass Assignment and Unsafe Consumption of APIs

Resource Abuse and Business Logic

Rate Limiting, Resource Consumption and Unrestricted Access

01Foundations of API Security Testing3 lessons

The API Attack Surface and the OWASP API Top 10
Importing OpenAPI and Postman Collections into Safeguard
Authenticated Session Handling for API Scans

02Broken Object and Function Level Authorization3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Server-Side Request Forgery and Injection in APIs

Business Logic Flaws Unique to APIs

Program Operations

Triage, Severity and Reporting for API Findings
Continuous API Security in Continuous Integration and Continuous Delivery (CI/CD)
Building an API Security Testing Program with Safeguard

BOLA: Object Level Authorization Failures

Broken Function Level Authorization and Privilege Escalation

Evidencing an IDOR Without Damaging Data

03Authentication and Data Exposure3 lessons

Broken Authentication in APIs: Tokens, Keys and Sessions
Excessive Data Exposure and Over-fetching
Mass Assignment and Unsafe Consumption of APIs

04Resource Abuse and Business Logic3 lessons

Rate Limiting, Resource Consumption and Unrestricted Access
Server-Side Request Forgery and Injection in APIs
Business Logic Flaws Unique to APIs

05Program Operations3 lessons

Triage, Severity and Reporting for API Findings
Continuous API Security in Continuous Integration and Continuous Delivery (CI/CD)
Building an API Security Testing Program with Safeguard2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.