P57

Tour the OWASP API Top 10

Walk all ten OWASP API Security risks and map each one to a real Lab defense you already built.

1
Open the OWASP tour and read API1: Broken Object Level Authorization.

Every risk is explained in plain language first — what actually goes wrong — before it’s tied to any Lab feature.
2
Follow its links to the real Lab practicals that demonstrate the defense (e.g. the FGA/ReBAC lab for BOLA).

The whole point of this capstone is realizing the Lab you already worked through IS a coherent OWASP API Security posture, not ten disconnected demos.
3
Mark all ten items reviewed as you go — the progress bar tracks it.

Reviewing every item (not just reading the page) is what this capstone actually asks of you; your progress is saved per item and survives a reload.

Do it

Do the steps above on the lab page, then come back and check your progress.

Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.