For candidates, employers and assessors
Credential standards
How Endpoint Lab credentials are earned, verified and kept current. Every figure on this page is read from the live certification engine.
What we certify
Certified API Integration Practitioner
Demonstrated competence in designing, consuming, securing and operating HTTP APIs across eight assessed domains.
Pass eight score-gated module tests (80%+), complete three server-verified practical missions, and pass a timed exam with 75% overall and at least 50% in every domain.
Certified API Security Practitioner
Demonstrated ability to threat-model APIs, prevent the OWASP API Security Top 10 risks, secure tokens and integrations, and verify defenses with hands-on evidence.
Pass all fourteen API Security lessons, complete six server-verified hands-on security labs, and pass a timed security exam with at least 80%.
Exam blueprint: Certified API Integration Practitioner
The exam draws 4 questions from each of 8 domains (32 questions in 45 minutes). Candidates pass with at least 75% overall and at least 50% in every domain, so strength in one area cannot hide a gap in another.
| # | Domain | Weight | Competence statement | Protected pool |
|---|---|---|---|---|
| 1 | API foundations | 12.5% | Explain the client/server request–response model | 15 items |
| 2 | Resources & methods | 12.5% | Choose correct HTTP methods and their safety/idempotency guarantees | 15 items |
| 3 | Parameters & payloads | 12.5% | Shape requests with parameters, JSON bodies, validation and pagination | 15 items |
| 4 | Authentication & security | 12.5% | Apply authentication, authorization, OAuth scopes and secret handling | 15 items |
| 5 | Errors & resilience | 12.5% | Design timeouts, retries, rate-limit handling and idempotent writes | 15 items |
| 6 | Integration patterns | 12.5% | Integrate with SDKs, webhooks, polling, streams, REST and GraphQL | 15 items |
| 7 | Contracts & testing | 12.5% | Use OpenAPI contracts, negative tests, versioning and observability | 15 items |
| 8 | Integration capstone | 12.5% | Operate an end-to-end resource lifecycle across control and data planes | 15 items |
120 protected exam items in total. They never appear in lessons or practice, answer keys never leave the server, and question selection and option order are randomised for every attempt.
Exam blueprint: Certified API Security Practitioner
16 questions in 25 minutes, pass mark 80%, drawn from a protected pool of 28 items across 3 stages:
- Foundations: Understand what API security protects and the basic defenses every API needs. (8 items)
- The common risks: Recognize and prevent the access-control and abuse problems behind most API incidents. (10 items)
- Production security: Secure tokens, integrations and operations, and build security into how your team ships. (10 items)
Practical competence, checked by a server
Knowledge alone does not earn a credential. Candidates complete practical missions against isolated, live API sandboxes (3 for the integration credential). The server grades each mission from recorded evidence: exact methods, status codes, request order, idempotency and recovery after injected faults. Clicking through a mission does not pass it.
Eligibility and preparation
- There are no formal prerequisites. Anyone may create an account and start learning.
- The integration exam unlocks after passing all eight module tests (6 questions in 15 minutes each, at least 80%) and the practical missions.
- Accommodations such as extra time or an accessible format are available on request to admin@stellersight.com before an attempt.
Attempts, integrity and results
- A failed exam can be retaken after 24 hours, at most 3 times in 30 days, with different questions each time.
- Leaving the exam window, exiting full screen, copying, pasting and opening developer tools are counted. With 6 or more events the result is held for human review before any certificate is issued. No camera, microphone or screen recording is used.
- Candidates see their score by domain immediately after the exam.
Verification and digital credential standards
- Every certificate has an unguessable ID, a QR code and a public verification page (/verify) showing whether it is valid, expired, revoked or under review.
- Certificates are signed with Ed25519. Public keys are published as a JSON Web Key Set at /api/verify/keys, so anyone can check a certificate offline.
- Certificates can be exported as Open Badges 3.0 verifiable credentials (VC-JWT) for digital wallets and LinkedIn. The issuer profile, achievement definitions and signing keys are published at stable URLs, and exported badges validate against the 1EdTech Open Badges 3.0 JSON schema.
Validity, renewal and revocation
Certificates are valid for 24 months. Recertification opens 90 days before expiry and issues a new credential. Certificates may be revoked for issuance errors, confirmed misconduct or fraud; the reason is shown publicly on the verification page.
Appeals and complaints
What you can appeal
Any decision about you under these standards: eligibility, a module or exam result, an integrity hold, a refusal to issue a certificate, a suspension, or a revocation.
How to appeal
Write to admin@stellersight.com within 30 days of being told of the decision, with the subject line “Appeal”. Include the email address of your account, the certificate ID if there is one, the decision you are appealing, why you think it is wrong, and any evidence you want considered.
What happens next
- We acknowledge your appeal within 5 working days.
- A reviewer who took no part in the original decision examines the attempt record, integrity events, grading evidence and anything you send. They may ask you for more information.
- You receive a written decision with reasons within 30 days of your appeal. If we need longer, we tell you why and when to expect it.
Possible outcomes
- The original decision is confirmed.
- The decision is overturned: a result is corrected, a hold is released, or a certificate is issued or restored.
- You are offered a free re-sit with different questions, which does not count toward the attempt limit.
If you disagree with the outcome
You may ask for a final review within 14 days of the appeal decision. A director of StellerSight Private Limited who was not involved before decides within 30 days, and that decision is final within this process.
Complaints
Complaints about the exam, the platform, our conduct or these standards follow the same timelines: acknowledgement within 5 working days and a written response within 30 days.
Fairness
Appealing or complaining never counts against you. Appeals are handled confidentially, every appeal and complaint is recorded with its outcome, and we review them regularly to improve the exam and these standards.
Recognition status
These are independent professional credentials issued by StellerSight Private Limited through Endpoint Lab. They are not university degrees or government-accredited qualifications. When a recognition, accreditation or endorsement is granted, it will be listed here with a link to the awarding body.
Full rules: certification policy. Questions: admin@stellersight.com.