API Design

Core: start here

• API TestingCalling endpoints and checking status codes, bodies and side effects.
• Double SubmissionA user clicking twice and creating two orders, and how to prevent it.
• PaginationReturning large result sets one page at a time.

Core: start here

• API DesignDesigning interfaces that are clear, consistent and hard to misuse.
• Error Response FormatA consistent shape for API errors, like RFC 9457 Problem Details.
• API VersioningEvolving an API without breaking existing clients.
• Idempotency KeyA client-supplied ID that makes retried requests safe.
• Offset vs Cursor PaginationSimple page numbers vs stable, scalable cursors.
• Rate LimitingLimiting how many requests a client can make.

• Bulk OperationsEndpoints that act on many items in one request.
• API-First DesignDesigning the API contract before implementing it.
• Contract TestingVerifying that services agree on the API contract between them.
• Designing WebhooksSignatures, retries, ordering and idempotency for outgoing webhooks.
• HATEOASResponses that include links to the possible next actions.
• Long-Running OperationsReturning 202 Accepted and a status URL for slow work.
• Public vs Internal APIsWhy public APIs need much more care about stability.
• Sparse FieldsetsLetting clients choose which fields they receive.
• Backend for Frontend (BFF)A backend tailored to one frontend's needs.
• Rate Limiting AlgorithmsToken bucket, leaky bucket, fixed window and sliding window.

• API Lifecycle ManagementDesigning, publishing, versioning and retiring APIs across an organization.

• PaginationReturning large result sets one page at a time.
• 429 Too Many RequestsThe status returned when a client goes over a rate limit.
• Rate LimitingLimiting how many requests a client can make.
• Bulk OperationsEndpoints that act on many items in one request.

Core: start here

• API TestingCalling endpoints and checking status codes, bodies and side effects.

• ETagA version identifier used for conditional requests and caching.
• HMACA keyed hash proving a message came from someone holding the secret.
• IdempotenceDoing something twice has the same effect as doing it once.
• API VersioningEvolving an API without breaking existing clients.
• Idempotency KeyA client-supplied ID that makes retried requests safe.
• Offset vs Cursor PaginationSimple page numbers vs stable, scalable cursors.
• Rate LimitingLimiting how many requests a client can make.
• Backward CompatibilityNew versions that still work with old clients.
• DeprecationMarking something for removal and giving users time to migrate.

• Contract TestingVerifying that services agree on the API contract between them.

Core: start here

• Double SubmissionA user clicking twice and creating two orders, and how to prevent it.

• API DesignDesigning interfaces that are clear, consistent and hard to misuse.
• WebhookAn HTTP callback: a service calls your URL when something happens.
• API ContractThe agreed shape and behavior of an API.
• API GatewayA single entry point handling routing, auth and rate limits for many services.
• Error Response FormatA consistent shape for API errors, like RFC 9457 Problem Details.
• ETagA version identifier used for conditional requests and caching.
• IdempotenceDoing something twice has the same effect as doing it once.
• OAuth Scopes and PermissionsLimiting what a token can do, e.g. read-only access.
• API VersioningEvolving an API without breaking existing clients.
• Idempotency KeyA client-supplied ID that makes retried requests safe.
• Offset vs Cursor PaginationSimple page numbers vs stable, scalable cursors.
• Rate LimitingLimiting how many requests a client can make.
• Backward CompatibilityNew versions that still work with old clients.
• DeprecationMarking something for removal and giving users time to migrate.

Core: start here

• Contract TestingVerifying that services agree on the API contract between them.