50 cards
REST, or Representational State Transfer, is an architectural style for designing scalable web APIs that leverages the standard HTTP protocol. At its heart, a REST API exposes resources—any named, addressable entity such as a user, an order, or a document—through URIs, and represents those resources in formats like JSO...
HTTP methods express the intended action on a resource, and choosing the right one is central to a clean REST design. GET retrieves a representation of a resource, POST creates a new resource or triggers a non-idempotent action, PUT replaces an entire resource with a new representation, PATCH applies partial modificati...
Well-designed URIs make an API feel intuitive to navigate. The dominant convention is hierarchical, noun-based paths that use plural nouns for collections, such as /users/123/orders/456, where each segment narrows the scope from collection to item to related sub-collection. Plural nouns make it obvious whether you are...
Status codes are the API's primary vocabulary for outcomes, and using them precisely saves clients from parsing message bodies to understand what happened. The 2xx range covers success: 200 OK is the default response for a successful GET, 201 Created is the right answer after a POST that produced a new resource (ideall...
JSON has become the de facto response format for REST APIs thanks to its compactness, readability, and near-universal language support. While XML and other formats are still possible, most modern APIs standardize on JSON for both request and response bodies. Rather than fix the format at design time, the more expressiv...
Most APIs eventually have to handle large collections, expensive operations, or many small requests, and a handful of patterns cover these needs. Pagination splits a large result set into pages using query parameters—either offset-limit style with ?page=2&limit=20 or cursor-based style with an opaque token that points...
REST APIs inherit the same threat landscape as any web service, and security must be designed in from the start. The foundation is HTTPS, which protects credentials and payloads in transit and lets clients trust the server's certificate. Beyond transport security, the OWASP API Security Top 10 highlights injection, bro...