Pragmatic REST APIs

The ASP.NET Core Web API Course That Goes Beyond CRUD

Pragmatic REST APIs is built around the parts most tutorials skip: persistence with EF Core and PostgreSQL, authentication with ASP.NET Core Identity and JWT, integration testing with WireMock, OpenAPI documentation, and automated deployment to Azure. 9 chapters, 14+ hours of video, updated to .NET 10.

Get instant access Preview free lessons

1,900+ engineers shipping better code

What "production-ready" means for a web API

Every C# web API tutorial ends in the same place: a controller, a DbContext, five endpoints, 200 OK. That's a demo. Production is where the real questions start.

A production-ready web API returns consistent errors with Problem Details. It authenticates users and authorizes every request. It survives concurrent updates, slow dependencies, and clients that retry. It has tests you trust enough to deploy on a Friday. It ships with documentation your consumers can actually use, and telemetry that tells you what broke before your users do.

This course treats those concerns as the main event, not an afterthought. We build one complete system in ASP.NET Core, and you get the full source code. If you want a taste of the depth, read my free guide on JWT authentication in ASP.NET Core. The course goes further than any single article can.

The curriculum, grouped by concern

9 chapters and 14+ hours of video, organized around what a web API needs in production: build it, secure it, harden it, test it, ship it.

Build

Chapters 1 to 3 · about 7 hours

Set up the project, model resources, and implement CRUD with EF Core and PostgreSQL. Then the parts most courses skip: validation with Problem Details, global exception handling, searching, filtering, sorting, pagination, and data shaping. Chapter 3 adds HATEOAS, content negotiation, and API versioning so you can evolve the API without breaking clients.

Secure

Chapter 4 · 2h 7m

Authentication with ASP.NET Core Identity, JWT access tokens with refresh tokens, role-based and attribute-based authorization (RBAC and ABAC), owner-only resource access, and encryption of sensitive data.

Flowchart of refresh token rotation where a presented token is rejected with 401 if invalid or revoked, and otherwise the old token is revoked and a new access and refresh token pair is issued — Refresh token rotation, one of the auth flows you implement in chapter 4.

Harden

Chapters 5 and 6 · about 2.5 hours

HTTP caching, optimistic locking for concurrency, cursor pagination for large data sets, rate limiting, idempotency for safe retries, webhooks, and asynchronous REST APIs. On the client side: a React application, batch operations, resilient HTTP clients with Refit and Polly, and OpenAPI client generation.

Sequence diagram of conditional requests where a client gets a resource with ETag v42, sends PUT with If-Match, and receives 204 No Content if the tag still matches or 412 Precondition Failed if the resource changed — Optimistic concurrency with ETags and If-Match, from the advanced concerns chapter.

Test

Chapter 7 · 1h 7m

Unit tests, integration tests that exercise the real API pipeline, mocking external services with WireMock, end-to-end tests, and running the whole suite in CI/CD pipelines.

Ship

Chapters 8 and 9 · about 1.5 hours

OpenAPI documentation with Swagger and Scalar, documenting multiple API versions and authentication flows, deploying the API and database to Azure, applying migrations, monitoring with Application Insights, and automating deployments with GitHub Actions.

The main course builds the API with controllers. The Community plan adds a bonus course that rebuilds it with Minimal APIs, so you can compare both approaches on the same codebase. New to Minimal APIs? Start with my free Minimal APIs guide.

See the full curriculum

Pricing: pay once, keep it forever

The basic plan is $247: all 9 chapters, the REST API Case Studies bonus, lifetime access, and email support. The Community plan is $397 and adds the Minimal APIs bonus course, the Auth0 Integration bonus course, priority support, and a private community where I answer questions personally.

Many students expense the course through their employer. You get a receipt after checkout, and I can provide a quote for multiple team seats through the contact page.

3D box mockup of the Pragmatic REST APIs in ASP.NET Core course by Milan Jovanovic

Get instant access

Frequently asked questions

Does the course use controllers or Minimal APIs?

The main course builds the API with controllers, which is still what most production ASP.NET Core codebases use. The Community plan adds a bonus course that rebuilds the endpoints with Minimal APIs, including HATEOAS, versioning, and documentation, so you can compare both approaches on the same API.

Which database and ORM does the course use?

PostgreSQL with Entity Framework Core. Everything you learn about persistence, migrations, and querying transfers directly to SQL Server or any other EF Core provider.

Does the course cover authentication and authorization?

Yes, in depth. You implement ASP.NET Core Identity, JWT access tokens with refresh tokens, role-based and attribute-based authorization, owner authorization, and encryption of sensitive data. The Community plan also includes a bonus course on integrating Auth0 as an external identity provider.

Is the course up to date with the latest .NET?

Yes. All course content is updated to .NET 10, and lifetime access means you get every future update at no extra cost.

Do I get the source code?

Yes. You get the full source code of the application we build throughout the course, so you can use it as a reference for your own projects.

What does the course cost?

The basic plan is $247 with all 9 chapters, the REST API Case Studies bonus, lifetime access, and email support. The Community plan is $397 and adds the Minimal APIs and Auth0 Integration bonus courses, priority support, and a private community with direct access to me.