vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable PHP Interface that demonstrates OWASP API Top 10 in the means of Exercises. Requires PHP, Apache, MySQL, and probably a man-in-the-middle proxy.