API Security Engineer
API Security Engineers specialise in identifying, communicating, and remediating security vulnerabilities in API surfaces. Their work spans from threat modelling API endpoints and writing security findings reports to explaining OAuth 2.0 grant type choices to developers and presenting API security posture to compliance teams. This path covers the authoritative vocabulary needed to discuss API authentication, authorisation, and attack surface management in technical and cross-functional settings.
Topics covered
- OWASP API Top 10
- JWT & token security
- OAuth 2.0 & PKCE
- Rate limiting algorithms
- mTLS vs API keys
- API threat modelling
Vocabulary spotlight
4 terms every API Security Engineer should know in English:
Broken Object Level Authorisation — the top OWASP API vulnerability, where an API endpoint fails to verify that the requesting user is authorised to access a specific resource object
"The BOLA finding showed that any authenticated user could access any invoice by simply changing the ID in the URL parameter."
A JWT vulnerability where an attacker modifies the token header to set the algorithm to "none", causing servers that accept unsigned tokens to bypass signature verification entirely
"The penetration test confirmed the alg:none attack was possible — the server was trusting the algorithm specified in the token header rather than enforcing it server-side."
A rate limiting algorithm where tokens accumulate in a bucket at a fixed rate up to a maximum capacity; each request consumes one token, allowing burst traffic up to the bucket's capacity
"We use a token bucket at the API gateway with a refill rate of 100 req/s and a burst capacity of 500 — legitimate clients can absorb traffic spikes."
Mutual Transport Layer Security — a TLS configuration where both client and server present cryptographic certificates for bidirectional authentication; each party verifies the other's identity
"For service-to-service API calls within the cluster, we require mTLS — no service can call the payment API without presenting a valid SPIFFE certificate."
📚 Vocabulary Reference
Key terms organised by category for API Security Engineers:
OWASP API Top 10
JWT & Token Security
OAuth 2.0 & Auth
API Protection Controls
Recommended exercises
Real-world scenarios you'll practise
- Explaining BOLA and the difference from BFLA (Broken Function Level Authorisation) to a backend team before a security sprint
- Writing a security finding report section on JWT algorithm confusion vulnerabilities for a penetration test report
- Presenting API security posture to a compliance officer: framing OWASP API Top 10 coverage and remediation status
- Recommending mTLS vs API key authentication for a new inter-service API to an architecture review board