Backend Web Development with Python

A backend web service takes requests over HTTP, validates them, reads and writes a database, enforces who is allowed to do what, and returns predictable responses — reliably, under load, without leaking secrets. This course builds one such service from an empty directory to a running, tested, containerised API, using **FastAPI** as the primary framework. The ideas are framework-neutral (Flask and Django REST are noted for contrast), so what you learn transfers. **Building an API (lessons 1–3).** You write a first FastAPI app and run it with **uvicorn**; add routing with path, query and body parameters validated by **Pydantic** models and returned through response models; and refactor into a maintainable project — a package with routers, settings read from the environment (12-factor), and dependency injection. **Data and CRUD (lessons 4–5).** You connect to **PostgreSQL 16** with **SQLAlchemy 2.0**, manage schema changes with **Alembic** migrations, handle sessions and connections safely, and implement full create, read, update and delete with pagination, correct status codes (201, 204, 404, 422) and clean error handling. **Security (lessons 6–7).** You add registration and login with **bcrypt**-hashed passwords and signed **JWT** tokens, protect routes with a dependency, and keep secrets out of code. Then you work through the security basics every backend needs: how the ORM prevents SQL injection, input validation as defence, CORS, rate limiting, and an OWASP-aware review of the API. **Testing, packaging, production (lessons 8–10).** You test the API with **pytest** and the **httpx**-based test client against a real transactional test database, containerise the app with a Dockerfile and a Compose stack (app plus PostgreSQL) with health checks, and finish with production concerns: structured logging, running migrations on deploy, readiness probes and observability, graceful shutdown, and the twelve-factor checklist. **Final project.** "Ship a ticket service": from an empty directory you deliver an authenticated, validated, tested and containerised ticket API, prove it runs, prove the tests pass, and prove that protected routes reject unauthenticated callers — graded against a rubric and automated lab checks. Everything runs on your own lab machine `linux01` (Ubuntu 24.04, Python 3.12, Docker). No cloud account is needed. The course is a learning pathway toward backend and platform work; it makes no promise of employment or any vendor certification, and its credential is an Ultiblob Certificate of Completion.