Cyber Wiki Learning Path
API Security Engineering
Design and test authentication, authorization, gateway policy, object access, resource controls, and real-time API behavior.
Recommended Sequence
7 connected entries
API Authentication and Token Validation
API authentication and token validation establish which principal is calling an API and whether the presented credential is authentic, current, intended for that audience, and permitted to support the requested action.
Application architecture concept · AdvancedAPI Gateway Security
An API gateway is an intermediary that routes and mediates API traffic and may enforce authentication, rate limits, schema controls, observability, transformation, and policy; securing it requires consistent edge policy without assuming the gateway can replace backend authorization.
Identity and access concept · IntermediateAccess Tokens, ID Tokens, and Refresh Tokens
Access Tokens, ID Tokens, and Refresh Tokens is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Application security concept · IntermediateBroken Object-Level Authorization
Broken Object-Level Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
API security concept · AdvancedGraphQL Security
GraphQL security protects a typed query interface in which clients select fields and traverse relationships; the server must enforce authorization, resource limits, safe resolver behavior, and controlled schema exposure for every requested object and field.
Application security concept · IntermediateREST API Security
REST API Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Real-time application security concept · AdvancedWebSocket Security
WebSocket security protects long-lived, bidirectional connections that begin with an HTTP upgrade and then carry application-defined messages outside the normal request-response pattern.