Module 1 — Perimeter decisions
Classify APIs into in-scope, out-of-scope with compensating controls, and deferred. Produce a one-page boundary rationale.
Flagship course
Fintech API Access Control Audit
Six modules that turn gateway configs, token inventories, and interview notes into an examiner-ready evidence story.
Modules
What you work through
Module 2 — Gateway and policy review
Read route policies, authn hooks, and admin interfaces the way a skeptical reviewer would — including shadow routes.
Module 3 — Entitlement sampling
Design stratified samples across consumer, partner, and internal clients. Document depth without implying exhaustive review.
Module 4 — OAuth and token hygiene
Trace scope grants, refresh patterns, and service accounts. Spot drift that silent product changes introduce.
Module 5 — Interview scripts
Practice questions for platform owners, product managers, and operations that surface who can revoke access in practice.
Module 6 — Findings memo lab
Draft severity-ranked findings with control language finance and compliance leads can endorse.
Learning outcomes
- Defend a written API access-control perimeter for a payment or open-banking stack.
- Apply sampling methods that examiners recognize as intentional, not arbitrary.
- Translate token and gateway evidence into plain-language control statements.
- Run structured interviews that do not collapse into architecture debates.
Informational pricing
Protocol Studio seats are listed at ₩2,450,000 per participant on our pricing page. No checkout occurs on this site.
Ji-young Han
Lead instructor. Former platform security lead at a Seoul-based payments firm; now focuses on audit rehearsal design for fintech API estates.
FAQ
Before you enroll
Do I need to bring our production configs?
No. We provide a shared fintech case system. If your employer allows redacted exports, optional homework can use your environment — we never require live secrets.
Is this a certification exam?
No. You receive a completion letter and artifact portfolio. We do not issue regulated licenses or substitute for formal auditor credentials.
What is a real limitation of this course?
Partner-bank and cross-border API bridges receive only an introductory clinic. Teams with heavy correspondent relationships usually need a Continuity Desk add-on or further internal work after Module 4.
What language is the cohort delivered in?
Live sessions and materials are in English. Office hours can accommodate clarifying questions from Korea-based teams when scheduled in advance.
Course reviews
From Protocol Studio alumni
“Module 3’s sampling worksheet replaced our habit of pasting entire grant dumps into the audit folder.”
Daeun · Seoul · API platform
“Interview scripts were sharper than I expected. The partner-bridge limitation called out in the FAQ is accurate — we still had homework after graduation.”
Marcus L. · Singapore · Risk operations