tag: rest
REST
REST APIs and identity: bearer tokens, SCIM's REST interface, and calling HTTP services securely.
Articles
- Events & community
API Security Today: The OWASP API Top 10 in Practice
A talk-style tour of the OWASP API Security Top 10 (2023): broken object level authorization, authentication flaws, resource limits, and fixes that work.
- Events & community
The API Economy in the Nordics: Banking, Public Data, Identity
How the Nordic countries became API-heavy: PSD2 open banking, public sector data APIs, bank-issued digital IDs, and what API teams there focus on for security.
- Authorization
OAuth 1.0a vs OAuth 2.0: What Still Matters Today
OAuth 1.0a signed every request; OAuth 2.0 relies on TLS and bearer tokens. How the two differ, where 1.0a survives and how to call a 1.0a API correctly.
- Cloud computing
Calling On-Premises Web Services From the Cloud, Securely
How cloud apps can call web services that still live in your data center: gateways, mTLS, token exchange and why you should not just open a firewall port.
Guides
- Platform category
API gateways
What an API gateway does for security: token validation, rate limits, schema checks, mTLS and routing; how it differs from an authorization server.
- IAM building block
Provisioning and SCIM
How user provisioning works: joiner, mover and leaver processes, SCIM 2.0 requests, connectors, just-in-time provisioning and reliable deprovisioning.