Web Development · WDC-120

Enterprise REST API with Python

Enterprise REST API with Python is a hands-on course in building a FastAPI REST API to enterprise standard, covering OpenAPI contracts, RFC 9457 error responses, JWT and role-based access, automated tests, OWASP API security and Docker deployment. It suits Python backend developers and tech leads who set API standards for their team, and you leave with a project template to reuse.

Updated 20 Oct 2026

From 8,010 THB / person 8,900 −10% excl. VAT 7% · group rates available

Corporate training quote Join the waiting list

PDFDownload the course outline

Duration18 hours · 3 days
FormatOnsite / live online
Next roundOn request
CertificateIncluded

Course overview

REST APIs are at the heart of enterprise software, connecting web apps, mobile apps, internal systems and external partners. Yet many APIs are built to work rather than to work well over the long term: error formats are inconsistent, there is no clear permission model, large lists are slow, tests are missing, and gaps from the OWASP API Security Top 10 are left open without anyone noticing.

This course takes one API deep on a sample procurement system, CorpFlow. Learners design resources and the contract with OpenAPI, build with FastAPI and Pydantic, manage data with SQLAlchemy 2, Alembic and PostgreSQL 18, authenticate with OAuth2/JWT, authorise with RBAC, return errors in the RFC 9457 Problem Details format, write automated tests, close security gaps and deploy with Docker, ending with a reference API the team can use as a template. (3 days, 6 hours per day, 18 hours in total, Intermediate level.)

What you’ll gain

Design REST APIs with resource-oriented design and use HTTP methods, status codes and headers correctly
Define the API contract with OpenAPI and produce documentation that frontend and mobile teams can use straight away
Build APIs with FastAPI and Pydantic in a layered architecture that is easy to maintain and test
Manage the database with async SQLAlchemy 2 and run migrations systematically with Alembic
Implement authentication with OAuth2/JWT and role-based authorisation down to the object level
Set consistent standards for errors, validation, pagination, filtering and versioning across the system
Write unit and integration tests and protect against the OWASP API Security Top 10
Prepare the API for production with structured logging, health checks and Docker

Who this course is for

Python backend developers who want to raise their APIs to enterprise standard
Developers moving from PHP, Java or C# who want to build APIs in Python
Tech leads who need to set shared API development standards for the team
Frontend and mobile developers who want to understand server-side API design properly

Prerequisites

Working Python, including functions, classes and type hints
A basic understanding of HTTP and JSON
Basic SQL such as SELECT, INSERT, UPDATE and JOIN, plus Git and the command line
No prior FastAPI, SQLAlchemy or Docker experience is needed; the course covers what you need, including async/await

Curriculum

Course Details

IT Genius already runs Building REST APIs with Python, Complete REST API Development with FastAPI and FastAPI with MS SQL Server, which focus on getting an API working. This course goes a step further and takes a single API to enterprise standard in every dimension: an OpenAPI contract, RFC 9457 Problem Details errors, OAuth2/JWT with RBAC down to the object level, automated tests against a real database, protection against the OWASP API Security Top 10 (2023), and logging and deployment with Docker.

Splitting a system into several services and connecting generative AI are covered in Python Microservices with Generative AI. It runs for 3 days, 6 hours per day (18 hours in total, 09:00-16:00), as a continuous workshop on a sample procurement system, CorpFlow, using generated data only. Learners use their own laptop with Docker installed, all tools are open source or free editions, and learners take home the CorpFlow source code and an API standards checklist to use as the team's template.

Day 1 REST API Design and FastAPI Foundations

Section 1: REST API Design Principles for the Enterprise

Resource-oriented design, URI naming and relationships between resources
Using HTTP methods, status codes and headers correctly, including safe and idempotent methods
Designing non-CRUD actions such as approving or cancelling a document
Workshop: design the resources and URIs of the CorpFlow procurement system

Section 2: API Contracts with OpenAPI

Design-first and code-first approaches and their trade-offs
The structure of OpenAPI 3.1 and customising the documentation FastAPI generates
Using OpenAPI as the contract between backend, frontend and mobile teams
Lab: write and review the Vendor and Purchase Request contract with a mock frontend team

Section 3: Lab: FastAPI and Project Structure

Set up the project with uv and Ruff
Layered architecture: router, service, repository and schema
Dependency injection, configuration with pydantic-settings and lifespan events
Lab: lay out the CorpFlow project as a template the team can reuse

Section 4: Lab: Validation with Pydantic

Separate request and response models
Field constraints, custom validators and model validators for business rules
Handling dates, times, monetary amounts and enums correctly
Lab: validation rules for purchase requests, such as spending limits and line items

Section 5: Workshop Day 1: Error Standards with RFC 9457

The Problem Details structure: type, title, status, detail and instance
A global exception handler for validation errors, business errors and unexpected errors
Defining system error codes the frontend can rely on
Workshop: Vendor and Purchase Request endpoints that return the same error format across the system (in-memory data for now)

Day 2 Data Layer, Authentication and Authorisation

Section 6: Lab: SQLAlchemy 2 with PostgreSQL 18

Declarative models with type annotations
Async sessions, transaction handling and the unit of work
Avoiding N+1 queries with the right loading strategy
Lab: move CorpFlow data from memory into PostgreSQL

Section 7: Migrations with Alembic

Autogenerate migrations and review them before applying
Migrations that do not disrupt a running system, such as adding a column in several steps
Seed data for development and testing
Lab: add a new column to the purchase request table without breaking the existing API

Section 8: Pagination, Filtering and Concurrency

Offset and cursor pagination and their performance trade-offs
Designing query parameters for filtering and sorting safely
Optimistic locking with ETag and If-Match to prevent lost updates
Lab: a cursor-paginated purchase request list filtered by status and department

Section 9: Lab: Authentication with OAuth2 and JWT

The OAuth2 password flow in FastAPI and storing passwords with Argon2
Access tokens, refresh tokens, token lifetimes and revocation
An overview of connecting to the organisation's identity provider through OpenID Connect, such as Keycloak (demonstration)
Lab: CorpFlow login and refresh tokens

Section 10: Workshop Day 2: RBAC and the Approval Flow

Designing roles and permissions for requesters, department heads and the procurement team
Dependencies that check permissions at endpoint level and object level
Recording an audit log of who did what to which record
Workshop: only department heads can approve purchase requests from their own department, with an audit log

Day 3 Testing, Security and Production Readiness

Section 11: Lab: Automated Testing for APIs

Unit tests for the service layer and overriding dependencies in FastAPI
Integration tests with HTTPX AsyncClient and a real PostgreSQL through Testcontainers
Measuring test coverage and organising tests so they stay maintainable
Lab: test the request and approval process end to end

Section 12: API Security with the OWASP API Security Top 10

Broken object level authorisation, broken authentication and broken object property level authorisation, and how to prevent them
Rate limiting, request size limits and correct CORS settings
Idempotency keys for operations that must not be duplicated
Lab: review CorpFlow against the OWASP API Security Top 10 (2023) checklist and fix what you find

Section 13: API Versioning and Evolution

Versioning through the URI, headers and media types, and their trade-offs
Changing an API without breaking existing clients
Announcing deprecation and sunset dates so API consumers know in advance
Lab: add a new field and release v2 of the purchase request endpoint while existing clients keep working

Section 14: Lab: Logging, Observability and Docker

Structured JSON logging and correlation IDs across requests
Health checks, readiness endpoints and an overview of extending with OpenTelemetry
A small multi-stage Dockerfile that does not run as root
Docker Compose for the API and PostgreSQL, with secrets passed through the environment
Setting the number of workers and Uvicorn options for production

Section 15: Master Workshop: CorpFlow API Ready for Production

Extend the tests to cover requests, approvals and permission failures
Add rate limiting, idempotency keys and structured logging
Deploy the whole system with Docker Compose
Present the API with its OpenAPI documentation and the team's standards checklist

Schedule & training options

For individuals — public rounds

No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770

Join the waiting list Ask about rounds

For organisations — in-house / private

Tailor the content to your team’s tools and projects
Your dates, at your office or live online
Quotation with tax ID for procurement

Corporate training quote

Instructors

Samit KoyomFounder & CEO, IT Genius Engineering

Frequently asked questions

How does this course differ from Building REST APIs with Python, Complete REST API Development with FastAPI and FastAPI with MS SQL Server?

Those courses focus on getting an API working, covering REST basics, FastAPI and database access. This course assumes you want to take an API to enterprise standard, so it goes deep on one API in every dimension: an OpenAPI contract, RFC 9457 errors, pagination and optimistic locking, OAuth2/JWT with RBAC down to the object level, tests against a real database with Testcontainers, the OWASP API Security Top 10 and deployment readiness. Python Microservices with Generative AI, launched alongside it, focuses on splitting a system into services and connecting generative AI.

Can I join if I have never used FastAPI or Docker?

Yes. The course covers the FastAPI, SQLAlchemy, async/await and Docker basics you need. You should write working Python, understand functions, classes and type hints, know HTTP and JSON, and use basic SQL. Developers coming from PHP, Java or C# who already understand REST will follow comfortably.

What is RFC 9457 Problem Details, and why use it?

RFC 9457 is the IETF standard for HTTP API error responses, with the fields type, title, status, detail and instance, replacing the earlier RFC 7807. When every endpoint returns errors in the same shape, frontend and mobile teams can handle errors with one piece of code across the system. In the course you build a global exception handler that turns validation, business and unexpected errors into Problem Details with system error codes.

Which edition of the OWASP API Security Top 10 does the course use?

The 2023 edition, the latest OWASP had published as of October 2026. The content focuses on the gaps most often found in enterprise APIs, such as broken object level authorisation, broken authentication and broken object property level authorisation. Learners review their own API against the checklist and fix what they find. If OWASP publishes a new edition, the content follows the latest one on the training day.

Can the login system connect to our Active Directory or Keycloak?

The labs build login with the OAuth2 password flow and JWT inside the API, so you see the whole mechanism, including access tokens, refresh tokens and revocation. Connecting to an organisation's identity provider through OpenID Connect is covered as concepts and a Keycloak demonstration, because every organisation runs a different system. The same approach applies to any identity provider that supports OpenID Connect.

How should I prepare my laptop?

Bring your own laptop with at least 8 GB of RAM (16 GB recommended) and 20 GB of free disk. Install Docker Desktop (with WSL2 on Windows) or Docker Engine, Python 3.14 or later, uv, Git, VS Code or PyCharm, and an API client such as Bruno or Postman before the training day. On a company laptop, check that you are allowed to install software and download packages and Docker images.

Articles are published in Thai.