IICTI Certified API Developer

Holders demonstrate that they can apply and evaluate aPI paradigm selection and resource modelling trade-offs, contract-first development and specification governance, aPI versioning, evolution and lifecycle management and aPI authentication and fine-grained authorisation, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for API Developer.

Who it is for: Professionals working, or preparing to work, in software development roles.

1. 01API paradigm selection and resource modelling trade-offs12% of the exam

   • Evaluate and select API styles and resource models that fit domain, consumer and performance constraints.
   • Scope: REST resource modelling and HTTP semantics (RFC 9110), GraphQL schema design and query cost, gRPC/Protobuf, event-driven APIs with AsyncAPI, selection criteria by coupling, latency and client needs.
2. 02Contract-first development and specification governance12% of the exam

   • Design contract-first workflows with automated governance that keep specifications authoritative and consistent.
   • Scope: OpenAPI 3.1/3.2 and JSON Schema 2020-12, AsyncAPI 3.0, Spectral linting and style guides, design reviews, code generation pipelines, schema registries.
3. 03API versioning, evolution and lifecycle management10% of the exam

   • Lead API evolution strategies that ship change without breaking consumers.
   • Scope: Backward and forward compatibility rules, breaking change detection with oasdiff, Deprecation (RFC 9745) and Sunset (RFC 8594) headers, consumer-driven contract testing with Pact, retirement planning.
4. 04API authentication and fine-grained authorisation10% of the exam

   • Architect API identity and authorisation that enforces least privilege at object and function level.
   • Scope: OAuth 2.1 and OIDC, PKCE, DPoP (RFC 9449), mTLS-bound tokens (RFC 8705), token exchange (RFC 8693), FAPI 2.0, policy engines (OPA, Cedar) and relationship-based access control.
5. 05API threat mitigation and security testing13% of the exam

   • Evaluate API designs and implementations for security weaknesses and build automated security testing into delivery.
   • Scope: OWASP API Security Top 10 2023 (BOLA, BFLA, mass assignment, SSRF, unrestricted resource consumption), schema-based validation, fuzzing with Schemathesis, DAST in CI, shadow and zombie API discovery.
6. 06Resilience, idempotency and traffic management7% of the exam

   • Design APIs and clients that degrade gracefully and remain correct under failure and overload.
   • Scope: Idempotency keys, retries with exponential backoff and jitter, timeouts and deadline propagation, circuit breakers, token bucket and GCRA rate limiting, RateLimit header fields, load shedding.
7. 07Distributed consistency and webhook delivery7% of the exam

   • Design API interactions that preserve data integrity across distributed services and asynchronous callbacks.
   • Scope: Sagas and transactional outbox, idempotent consumers, conditional requests with ETags and optimistic concurrency, eventual consistency semantics, Standard Webhooks signing, retries and replay protection.
8. 08API performance and scalability engineering12% of the exam

   • Diagnose and optimise API latency and throughput using measured evidence and caching strategy.
   • Scope: HTTP/2 and HTTP/3 (QUIC), HTTP caching (RFC 9111) and CDN strategy, cursor and keyset pagination, compression and payload shaping, N+1 avoidance in GraphQL, load testing with k6.
9. 09API gateways, service mesh and platform engineering6% of the exam

   • Architect API platform layers that centralise cross-cutting policy without becoming a delivery bottleneck.
   • Scope: Envoy, Kong and Apigee gateway patterns, Kubernetes Gateway API, backend-for-frontend, Istio policy enforcement, developer portals and self-service onboarding, internal developer platforms.
10. 10API observability and operational excellence6% of the exam

    • Design observability and SLO practices that let teams detect, explain and prioritise API reliability issues.
    • Scope: OpenTelemetry distributed tracing, RED metrics, per-endpoint SLOs and error budgets, Problem Details for HTTP APIs (RFC 9457), structured logging, consumer usage analytics.
11. 11API governance, productisation and regulatory compliance5% of the exam

    • Lead API programme governance that aligns product value, consistency and regulatory obligations.
    • Scope: API product management and monetisation, API inventory and catalogues (RFC 9727), open banking and PSD2 / FAPI ecosystems, GDPR data minimisation in API design, API governance operating models.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner