Home›Programs›Design and secure a REST API
Back-end & frameworks

Design and secure a REST API

REST principles, resource design, OpenAPI documentation and API security.

Request this program
Duration
14 h · 2 days
Level
Intermediate
Format
On site · Remote · Blended
Max. group size
12 participants

Overview

This program teaches how to design clear, durable REST APIs: principles of REST architecture, resource modeling, conventions, pagination and filters, documentation with OpenAPI, authentication and security. Participants design a complete API and test it with the usual tools.

Who this program is for

  • Back-end and full stack developers
  • Architects and tech leads
  • Mobile developers who consume APIs

Prerequisites

  • Basics in a programming language
  • Notions of HTTP and JSON

Learning objectives

  • Explain the constraints of REST architecture
  • Design consistent resources, verbs and response codes
  • Handle pagination, sorting, filters and versioning
  • Document an API with OpenAPI and Swagger
  • Set up authentication and authorization (JWT, OAuth, OpenID)
  • Know the security risks of APIs

Detailed curriculum

4 modules · 14 h · 2 days

Day 1
REST principles3.5 h
50% theory · 50% practice
  • Origins and constraints of REST architecture
  • Resources, representations and URIs
  • HTTP verbs and idempotence
  • Status codes and headers
  • REST, RPC and GraphQL: comparison
Designing RESTful services3.5 h🛠 1 workshop
30% theory · 70% practice
  • Modeling the resources of a domain
  • Naming conventions
  • Sub-resources and relations
  • Error handling: response format
  • Versioning
🛠 Hands-on workshops
API design1.5 h

Design the API of a booking application.

✅ Deliverable : An API schema
Day 2
Common features and documentation3.5 h🛠 1 workshop
30% theory · 70% practice
  • CRUD, pagination, sorting and filters
  • Partial updates
  • Description with OpenAPI
  • Generating interactive documentation
  • Hypermedia formats: overview
🛠 Hands-on workshops
Documenting the API2 h

Write the OpenAPI specification of the API you designed.

✅ Deliverable : An OpenAPI specification
Authentication and security3.5 h🛠 1 workshop
30% theory · 70% practice
  • Token authentication, JWT
  • OAuth 2 and OpenID Connect: principles
  • Permissions and scopes
  • Classic threats: OWASP API, CORS, CSRF
  • Rate limiting and logging
🛠 Hands-on workshops
Security review1.5 h

Audit a demo API and propose fixes.

✅ Deliverable : A security report

Tools and technologies

PostmanVisual Studio Code

Teaching methods

  • Alternating short lectures and hands-on work
  • Live demonstrations by the trainer
  • Capstone project built throughout the modules
  • Group corrections and discussion of best practices

Assessment

  • Hands-on exercises corrected in each module
  • Mini-project completed at the end of the course
  • Knowledge-check quiz

Required equipment

  • A computer with an internet connection
  • An API testing tool (Postman or equivalent)
  • A code editor

Resources provided

  • Course materials and repository of corrected exercises

Career outcomes

  • A documented API contract
  • A reusable design grid
  • API security reflexes
Request this program← All programs