OWASP crAPI is a deliberately vulnerable microservices application built around realistic API workflows. This guide starts the stable stack locally, verifies the web app and MailHog, explains account creation, and gives repeatable commands for BOLA, mass-assignment, data-exposure, and business-logic training.
What is OWASP crAPI?
crAPI means completely ridiculous API. It is an OWASP training project that models a modern application with multiple services, user accounts, vehicles, messages, email, and API-driven workflows. The app is intentionally vulnerable so learners can study the OWASP API Security Top 10 in a controlled environment.
Unlike a single-page vulnerable website, crAPI is best learned by completing the normal user journey first. Register, verify the account through MailHog, add a vehicle, and explore the regular features before testing a challenge.
Download, install, run and test OWASP crAPI
crAPI is a deliberately vulnerable microservices application for learning API authorization, mass assignment, inventory and business-logic risks. The stable Compose files are downloaded directly from the official main branch.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
crAPI uses several cooperating services. Confirm that the application and supporting interfaces are available first, then continue to the walkthrough to understand the normal user flow before reviewing security behavior.
Use the happy path before the security challenges
Register a user, verify the account through MailHog, sign in, add a vehicle, visit the community area, and use the normal application features. This baseline matters because API abuse is easiest to recognize when you understand what a legitimate client is supposed to do.
When you begin the mass-assignment and authorization exercises, record the endpoint, method, expected object owner, fields sent by the client, and fields returned by the server. That simple structure turns a one-off challenge into a reusable API testing method.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| One service remains unhealthy | Container logs | Run |
| Verification email is missing | MailHog and email domain | Use an |
| Port 8888 is busy | Existing process or container | Stop the process using 8888, or change the host port in the Compose file. |
| Compose interpolation error | Old Compose version | Run |
How Ammune helps with production risks represented by crAPI
crAPI is the closest of these labs to a modern API estate. Its challenges represent object-level authorization, mass assignment, excessive data exposure, weak rate controls, unsafe business flows, and microservice trust problems.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| BOLA and IDOR | A user changes an object identifier and reads or changes another user’s resource. | Model normal user-to-object access and highlight unusual object enumeration or cross-account access patterns. |
| Mass assignment and BOPLA | Unexpected JSON properties change protected fields or expose restricted object properties. | Compare observed request and response structures with learned schemas and surface unexpected or sensitive properties. |
| Excessive data exposure | The API response returns personal, operational, or secret data that the client does not need. | Inspect responses for PII, PCI, tokens, secrets, and unusually large or sensitive payloads. |
| Business-flow abuse | Valid endpoints are automated or sequenced in a way that defeats the intended business process. | Use behavior analytics, rate context, sequence context, and risk scoring to distinguish normal use from abuse. |
Related Ammune guidance: BOLA IDOR API security Mass assignment API vulnerability API behavior analytics OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Why is crAPI useful for API security training?
It uses realistic microservices, identities, objects and business workflows, making authorization and data-exposure lessons easier to connect to production APIs.
What is the crAPI happy path?
It is the normal user journey: register, verify the account, sign in, add a vehicle and use the application before testing any challenge.
What does MailHog do in crAPI?
MailHog captures local training email so account verification and password-related messages can be viewed without sending real email.
What is mass assignment in an API?
Mass assignment happens when an API binds user-controlled fields to an internal object without restricting which properties may be changed.
Why are BOLA and IDOR important in crAPI?
They demonstrate how valid users can access another user’s object when authorization is not checked for every requested resource.
How can Ammune help with similar production risks?
Ammune can learn normal API behavior, correlate identity and object access, inspect sensitive responses and produce risk-ranked runtime evidence.
Apply the lessons from OWASP crAPI to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.