vAPI
Vulnerable Adversely Programmed Interface: self-hostable API that mimics OWASP API Top 10 through exercises. PHP/Laravel; Postman collection and docs at http://localhost/vapi/.
Notes
Import vapi.sql into MySQL; configure vapi/.env. docker-compose up -d or php artisan serve.