Lion Cipher Lab
Talk to a REST API and read JSON
- AppSec / DevSecOps
- Beginner
- ~30 min
- Free · no account required
Why it matters
A REST API is just a web address you send an HTTP request to that answers with data instead of a web page — and the data is almost always JSON, a simple text format of key/value pairs, objects, and arrays. That one sentence covers an enormous share of modern software: cloud platforms, security scanners, threat-intel feeds, ticketing systems, and the services you'll eventually test all expose an API and all speak JSON. If you can send a GET to an API, recognize the JSON that comes back, and pull the one field you care about out of it, you can automate against nearly any tool in the field and…
What you'll learn
- making a GET request to a REST API
- recognizing JSON: objects, arrays, key/value pairs
- pretty-printing JSON with jq
- selecting fields out of a JSON response with jq
- pretty-printing JSON with Python's built-in json
- reading a real-world API (GitHub public endpoints)
- understanding API keys and auth at a high level
- never hard-coding secrets
Steps in this lab
- What an API is — and the ground rules, again
- Your first API call: a GET that returns JSON
- Read the JSON: objects, arrays, and key/value pairs
- Pretty-print and pick apart JSON with jq
- No jq? Pretty-print with Python's built-in json
- Point it at a real-world API: GitHub's public endpoints
- API keys and auth — and the one rule you never break
- What you just learned — and where it goes next