REST API Engineering with Python
Design, secure and scale production REST APIs — JWT and OAuth2, throttling and rate limits, idempotency, caching, versioning and observability — with Django REST Framework and FastAPI.
Is this for you?
Join if…
- You build APIs at work and want to do it like a senior engineer
- You know Django or FastAPI basics but struggle with auth, rate limiting or versioning
- You’re preparing for backend interviews where API design is a core round
Pick another programme if…
- You’re new to Python — start with the Launchpad, or take the full Backend programme
By the end, you’ll be able to
Curriculum
Every module, every topic and every lab — nothing hidden.
01API design that scales7 topics · hands-on labWeek 1
Get the contract right before you write code.
- Resource modelling, naming and URL design
- HTTP methods, safety and idempotency semantics
- Status codes that tell the truth
- Request/response conventions and envelope vs bare responses
- Errors with RFC 9457 Problem Details
- API-first design with OpenAPI 3.1
- REST vs GraphQL vs gRPC — when to use which
02Building APIs with DRF and FastAPI6 topics · hands-on labWeek 2
Implement the same API in both leading Python frameworks.
- DRF serializers, ViewSets and routers
- FastAPI path operations and dependency injection
- Validation with serializers and Pydantic v2
- Nested resources and relationships
- Bulk create/update endpoints
- File uploads: multipart and presigned S3 uploads
03Authentication: JWT, sessions & API keys8 topics · hands-on labWeek 3
Authentication done properly — not copied from a blog.
- Sessions vs tokens vs API keys — choosing the right one
- JWT structure, claims and signing (HS256 vs RS256/ES256)
- Access and refresh tokens with expiry
- Refresh-token rotation, reuse detection and revocation (deny-lists)
- Key rotation and JWKS endpoints
- Secure token storage: HttpOnly cookies vs headers
- SimpleJWT in DRF and OAuth2PasswordBearer in FastAPI
- API keys for machine clients: hashing, scopes and rotation
04Authorisation & OAuth27 topics · hands-on labWeek 4
Decide exactly who can do what.
- OAuth 2.0 flows: authorization code + PKCE, client credentials
- Scopes and consent
- OpenID Connect and social login
- Role-based access control (RBAC)
- Object-level and attribute-based access control (ABAC)
- Multi-tenant data isolation
- Preventing broken object-level authorisation (BOLA)
05Throttling, rate limiting & abuse protection9 topics · hands-on labWeek 5
Keep your API fast and fair under load — and under attack.
- Throttling vs rate limiting vs quotas
- Algorithms: fixed window, sliding window, token bucket and leaky bucket
- Redis-backed distributed rate limiting
- DRF throttle classes: AnonRateThrottle, UserRateThrottle, ScopedRateThrottle and custom throttles
- Rate limiting in FastAPI with slowapi and custom middleware
- Per-user, per-IP, per-API-key and per-plan limits
- RateLimit headers and 429 Retry-After responses
- API gateway throttling (AWS API Gateway usage plans)
- Bot and brute-force protection
06Reliability: idempotency, concurrency & async work6 topics · hands-on labWeek 6
Make every endpoint safe to retry.
- Idempotency keys for POST requests
- Optimistic concurrency with ETags and If-Match
- Conditional requests and 304 Not Modified
- Long-running work: 202 Accepted, job status and polling
- Webhooks: delivery, retries and signatures
- Timeouts, retries and circuit breakers when calling other APIs
07Performance, pagination & caching7 topics · hands-on labWeek 7
Fast APIs at any scale.
- Offset vs cursor (keyset) pagination
- Filtering, sorting and field selection (sparse fieldsets)
- Avoiding N+1 queries and profiling endpoints
- HTTP caching: Cache-Control, ETag and Vary
- Server-side caching with Redis
- Compression and response size
- Async I/O for high-concurrency endpoints
08Versioning, testing, docs & observability7 topics · hands-on labWeek 8
Evolve APIs without breaking anyone.
- Versioning strategies: URL, header and media type
- Deprecation policies and the Sunset header
- Contract and property-based testing (pytest, Schemathesis)
- Interactive docs with Swagger UI and ReDoc; generating client SDKs
- Structured logging, request IDs and tracing
- Metrics, alerts and SLOs
- OWASP API Security Top 10 checklist
What you’ll build
Tools & technologies
Who mentors you
Working senior Python developers and team leads — people who build and ship AI and backend systems for clients every week. They run the live sessions, review your code on GitHub and conduct your mock interviews. You learn the way their own teams work.
Your certificate
EZB-AIE-2026-0001
Issued 2026
Certificate of Completion
This is to certify that
has successfully completed the mentor-led programme
Ezibell Tech
Issued by Ezibell Tech, an MSME (Udyam) and GST registered company in India, with a unique ID listed on our public verification page.
Questions learners ask
Still unsure? Ask the team on WhatsApp or call +91 93981 39619.
How is this different from the Backend programme?
Backend Engineering covers the full stack of backend skills over 16 weeks. This 8-week programme goes much deeper on APIs alone — security, rate limiting, reliability, performance and versioning. Take it on its own, or after the Backend programme.
Do we use Django REST Framework or FastAPI?
Both. Most labs are built in both frameworks so you understand the concepts, not just one library.
Is JWT always the right choice?
No — and you’ll learn when it isn’t. We compare sessions, JWTs and API keys, and cover the security pitfalls of each.
Will we load-test the APIs?
Yes. You’ll use Locust to load-test your rate limits and performance improvements.
Does this help in interviews?
Yes. API design, authentication and rate limiting are standard backend interview topics, and the capstone gives you a strong project to discuss.
What laptop or setup do I need?
A laptop with 8 GB RAM. PostgreSQL, Redis and Docker run free on your machine; we provide a starter repository.
Are classes live or recorded?
Live and interactive, with mentors answering your questions in the session. Every session is also recorded so you can revise or catch up.
When are the classes?
Live online · weekday evenings or weekends. Exact timings are shared before each batch starts, and we plan them around working hours and college schedules.
What if I miss a class?
Watch the recording, finish the lab, and bring questions to the next doubt session or the mentor group. Falling behind is normal — just tell your mentor early.
Which language are classes taught in?
Simple, clear English. If you’d like help in Hindi during doubt sessions, ask us when you enrol.
How big is a batch?
We keep batches small so mentors can review everyone’s code. Ask us for the current batch size.
How do I get my doubts solved?
Ask in the live session, post in the private mentor group, or bring it to the weekly doubt-clearing session. Mentors also comment directly on your GitHub pull requests.
How do I earn the certificate?
Complete the hands-on labs and the capstone or final project. Your mentor reviews and signs it off, and your certificate is issued with a unique ID listed on our public verification page.
Is the certificate recognised?
It’s issued by Ezibell Tech, a Government of India–registered company (MSME/Udyam and GST registered), and carries a unique ID that anyone can verify online. It’s a professional training certificate — not a university degree or a government accreditation — and its real value comes from the projects you build and the mentors who can vouch for your work.
Do I keep access to the recordings and materials?
Yes, recordings and materials stay available after the programme ends. Ask us for the exact access period for your batch.
Do I own the projects I build?
Yes. Everything lives in your own GitHub account and is yours to show employers.
What are the fees? Is EMI available?
Fees depend on the programme and batch. Message us on WhatsApp or call, and we’ll share the current fee, instalment options and any student or early-bird discount within a few hours.
What is the refund and batch-transfer policy?
Refund and batch-transfer terms are shared in writing before you pay, so you know exactly where you stand.
Do you guarantee a job or placement?
No — and be careful of anyone who does. We give you real skills, a portfolio, interview practice and introductions within our network.
Can I talk to a mentor before enrolling?
Yes. Book a free counselling call on WhatsApp or phone. We’ll look at your background and recommend the right programme — honestly, even if it’s a different one.