🔒 API Security WorkshopOverviewSetupPre-RequisitesWorkshop GuideQuick ReferenceFacilitator Guide← Lab Portal

Quick Reference — API Security Workshop

URLs

Service URL
Setup (start here) https://portal.security-lab.cloud/workshop/setup
Workshop Guide https://portal.security-lab.cloud/workshop
crAPI https://crapi.security-lab.cloud
MailHog https://mailhog.security-lab.cloud
API Client (Hoppscotch) https://hoppscotch.security-lab.cloud
AI API https://ai.security-lab.cloud
APISec Console https://apisec.security-lab.cloud

Your Credentials
Email participantXX@workshop.lab
Password Workshop@2026

Key API Endpoints

crAPI — https://crapi.security-lab.cloud

Endpoint Method Description
/identity/api/auth/login POST Login → get JWT token
/identity/api/v2/vehicle/vehicles GET List your vehicles + UUIDs
/identity/api/v2/vehicle/{uuid}/location GET BOLA target
/identity/api/v2/user/dashboard GET Your profile
/community/api/v2/community/posts/recent GET Community posts

AI API — https://ai.security-lab.cloud

Endpoint Method Auth Description
/v1/chat/completions POST Bearer key Normal AI chat
/debug/config GET None API3: Sensitive data!
/v1/admin/users GET Any key API5: BFLA!
/mcp/tools/call POST Bearer key MCP tool invocation
/v1/models GET Bearer key List models

AI API Key (for workshop)

sk-workshop-2026

Hoppscotch Environment Variables

Variable Value
BASE_URL https://crapi.security-lab.cloud
AI_URL https://ai.security-lab.cloud
TOKEN (auto-set by the Login request)
MY_UUID (auto-set by the Own Vehicle request)
VICTIM_UUID (pre-filled — participant 01's vehicle)

Easiest path: open the Setup page and download your personal environment — these variables come pre-configured. The TOKEN fills itself in when you run the Login request.

Import Collection

https://portal.security-lab.cloud/workshop/hoppscotch/collection.json

(In Hoppscotch: Collections → Import → Import from URL. Or use the Setup page.)

OWASP API Top 10 — Workshop Coverage

# Vulnerability Where Demonstrated
API1 BOLA crAPI /vehicle/{uuid}/location
API3 Sensitive Data Exposure AI API /debug/config
API4 Unrestricted Resource Consumption Community posts with limit=9999
API5 BFLA AI API /v1/admin/users
API8 Improper Asset Management AI API debug + MCP endpoints
API10 Unsafe API Consumption Prompt injection

Akamai API Security Workshop | security-lab.cloud