# apiguide.dev

> The flagship reference site for modern, authoritative API design patterns, Problem+JSON error schemas, and integration guides.

## Core Sections

- [Errors](/errors): Detailed documentation of common HTTP API error patterns.
- [Status Codes](/status-codes): Comprehensive catalog of HTTP response status codes with schemas and examples.
- [Headers](/headers): Reference guide for HTTP request and response headers.
- [Methods](/methods): Explanation of HTTP request methods, semantics, and safety properties.
- [Developer Guides](/guides): Best practices on Pagination, Versioning, Idempotency, Webhooks, Caching, and Error Handling.
- [Specifications](/specifications): Deep dives into OpenAPI, AsyncAPI, JSON Schema, JSON:API, and gRPC.
- [Tooling](/tools): Reviews and comparisons of gateway, debugging, testing, and observability API tools.

## Reference Directory

### API Errors
- [Account Frozen](/errors/account-frozen): HTTP 403: Forbidden
- [Expired Authentication Token](/errors/expired-authentication-token): HTTP 401: Unauthorized
- [Gateway Timeout](/errors/gateway-timeout): HTTP 504: Gateway Timeout
- [Idempotency Key Conflict](/errors/idempotency-key-conflict): HTTP 409: Conflict
- [Insufficient Funds](/errors/insufficient-funds): HTTP 402: Payment Required
- [Insufficient Scope](/errors/insufficient-scope): HTTP 403: Forbidden
- [Internal Server Error](/errors/internal-server-error): HTTP 500: Internal Server Error
- [Invalid Pagination Cursor](/errors/invalid-pagination-cursor): HTTP 400: Bad Request
- [Invalid Query Parameter](/errors/invalid-query-parameter): HTTP 400: Bad Request
- [Malformed Request Body](/errors/malformed-request-body): HTTP 400: Bad Request
- [Method Not Allowed](/errors/method-not-allowed): HTTP 405: Method Not Allowed
- [Not Acceptable](/errors/not-acceptable): HTTP 406: Not Acceptable
- [Payload Too Large](/errors/payload-too-large): HTTP 413: Payload Too Large
- [Precondition Failed](/errors/precondition-failed): HTTP 412: Precondition Failed
- [Precondition Required](/errors/precondition-required): HTTP 428: Precondition Required
- [Rate Limit Exceeded](/errors/rate-limit-exceeded): HTTP 429: Too Many Requests
- [Request Timeout](/errors/request-timeout): HTTP 408: Request Timeout
- [Resource Conflict](/errors/resource-conflict): HTTP 409: Conflict
- [Resource Not Found](/errors/resource-not-found): HTTP 404: Not Found
- [Service Unavailable](/errors/service-unavailable): HTTP 503: Service Unavailable
- [Stale Resource Version](/errors/stale-resource-version): HTTP 409: Conflict
- [Unauthorized](/errors/unauthorized): HTTP 401: Unauthorized
- [Unprocessable Query](/errors/unprocessable-query): HTTP 422: Unprocessable Entity
- [Unsupported Media Type](/errors/unsupported-media-type): HTTP 415: Unsupported Media Type
- [Validation Failed](/errors/validation-failed): HTTP 422: Unprocessable Entity

### HTTP Status Codes
- [100 Continue](/status-codes/100): The server has received the request headers and the client should proceed to send the request body.
- [101 Switching Protocols](/status-codes/101): The server understands the Upgrade header field sent by the client and is switching protocols.
- [102 Processing](/status-codes/102): The server has received and is processing the request, but no response is available yet.
- [103 Early Hints](/status-codes/103): Allows the server to send link headers to prefetch resources while compiling the main response.
- [200 OK](/status-codes/200): The request has succeeded. The response payload contains the requested resource representation.
- [201 Created](/status-codes/201): The request has been fulfilled and has resulted in a new resource being created.
- [202 Accepted](/status-codes/202): The request has been accepted for processing, but the processing has not been completed.
- [203 Non-Authoritative Information](/status-codes/203): The server is a transforming proxy that received a 200 OK from its origin but is returning a modified payload.
- [204 No Content](/status-codes/204): The request was successful, but the response body is intentionally empty.
- [205 Reset Content](/status-codes/205): The server fulfilled the request and desires that the user agent reset the document view.
- [206 Partial Content](/status-codes/206): The server is delivering only part of the resource due to a Range header sent by the client.
- [207 Multi-Status](/status-codes/207): The response body contains multiple independent status codes for a batch of sub-operations.
- [208 Already Reported](/status-codes/208): Used inside a 207 Multi-Status response to avoid repeatedly enumerating the same bound resource.
- [226 IM Used](/status-codes/226): The server has fulfilled a request for the resource and the response represents the result of applying one or more instance manipulations.
- [300 Multiple Choices](/status-codes/300): The request has more than one possible response and the user agent or user should choose one.
- [301 Moved Permanently](/status-codes/301): The requested resource has been assigned a new permanent URI and future references should use it.
- [302 Found](/status-codes/302): The requested resource resides temporarily under a different URI.
- [303 See Other](/status-codes/303): Directs the client to get the requested resource at another URI using a GET request.
- [304 Not Modified](/status-codes/304): Instructs the client that the cached version of the resource is still valid.
- [305 Use Proxy](/status-codes/305): Deprecated. Indicated that the requested resource had to be accessed through the proxy given in the response.
- [306 Unused](/status-codes/306): Reserved. Formerly defined as "Switch Proxy" in an early draft, this code was never used and is no longer part of the standard beyond being reserved.
- [307 Temporary Redirect](/status-codes/307): The resource resides temporarily under a different URI. Method must not be changed.
- [308 Permanent Redirect](/status-codes/308): The resource has been permanently moved. Method must not be changed.
- [400 Bad Request](/status-codes/400): The server cannot process the request due to client error (e.g., malformed syntax, invalid framing).
- [401 Unauthorized](/status-codes/401): The request lacks valid authentication credentials. The client must authenticate.
- [402 Payment Required](/status-codes/402): Reserved for future use. Used in modern APIs to indicate subscription limits or billing issues.
- [403 Forbidden](/status-codes/403): The client is authenticated but does not have access rights to the content.
- [404 Not Found](/status-codes/404): The server cannot find the requested resource or URI route.
- [405 Method Not Allowed](/status-codes/405): The requested URI exists, but the HTTP method used is not supported.
- [406 Not Acceptable](/status-codes/406): The server cannot produce a response matching the Accept headers sent by the client.
- [407 Proxy Authentication Required](/status-codes/407): The client must first authenticate itself with the proxy server.
- [408 Request Timeout](/status-codes/408): The server timed out waiting for the client to complete the request.
- [409 Conflict](/status-codes/409): The request conflicts with the current state of the target resource.
- [410 Gone](/status-codes/410): The resource is permanently deleted and has no redirect address.
- [411 Length Required](/status-codes/411): The server refuses to accept the request without a defined Content-Length header.
- [412 Precondition Failed](/status-codes/412): One or more preconditions in the request headers evaluated to false.
- [413 Content Too Large](/status-codes/413): The request body size exceeds the maximum limit allowed by the server.
- [414 URI Too Long](/status-codes/414): The URI requested by the client is longer than the server is willing to interpret.
- [415 Unsupported Media Type](/status-codes/415): The request payload media format is not supported by the server.
- [416 Range Not Satisfiable](/status-codes/416): The requested byte range cannot be satisfied by the server.
- [417 Expectation Failed](/status-codes/417): The server cannot meet the requirements of the Expect request header.
- [418 I'm a teapot](/status-codes/418): Returned by hyper text coffee pot control protocol clients.
- [421 Misdirected Request](/status-codes/421): The request was directed at a server that is not able to produce a response.
- [422 Unprocessable Entity](/status-codes/422): The request body was syntactically correct but failed semantic business rules validation.
- [423 Locked](/status-codes/423): The resource that is being accessed is locked.
- [424 Failed Dependency](/status-codes/424): The request failed because it depended on another action that failed.
- [425 Too Early](/status-codes/425): The server is unwilling to risk processing a request that might be replayed.
- [426 Upgrade Required](/status-codes/426): The server refuses to perform the request using the current protocol.
- [428 Precondition Required](/status-codes/428): The origin server requires the request to be conditional.
- [429 Too Many Requests](/status-codes/429): The user has sent too many requests in a given amount of time.
- [431 Request Header Fields Too Large](/status-codes/431): The server refuses to process the request because header fields are too large.
- [451 Unavailable For Legal Reasons](/status-codes/451): The server operator has received a legal demand to deny access to the resource.
- [500 Internal Server Error](/status-codes/500): The server encountered an unexpected condition that prevented it from fulfilling the request.
- [501 Not Implemented](/status-codes/501): The server does not support the functionality required to fulfill the request.
- [502 Bad Gateway](/status-codes/502): An upstream server returned an invalid response to the gateway proxy.
- [503 Service Unavailable](/status-codes/503): The server is temporarily down or overloaded. The client should retry.
- [504 Gateway Timeout](/status-codes/504): The upstream server failed to send a timely response to the gateway proxy.
- [505 HTTP Version Not Supported](/status-codes/505): The server does not support the HTTP protocol version used in the request.
- [506 Variant Also Negotiates](/status-codes/506): Content negotiation for the request results in a circular reference.
- [507 Insufficient Storage](/status-codes/507): The server is unable to store the representation needed to complete the request.
- [508 Loop Detected](/status-codes/508): The server terminated the operation because it detected an infinite loop.
- [510 Not Extended](/status-codes/510): Further extensions to the request are required for the server to fulfill it.
- [511 Network Authentication Required](/status-codes/511): The client needs to authenticate to gain network access.

### HTTP Headers
- [Accept](/headers/accept): Specifies the media types that the client is willing to receive in the response.
- [Accept-Encoding](/headers/accept-encoding): Declares what compression algorithms the client supports for the response payload.
- [Accept-Language](/headers/accept-language): Advertises the natural languages the client prefers for the response.
- [Accept-Ranges](/headers/accept-ranges): Advertises whether a server supports range requests for a resource.
- [Access-Control-Allow-Credentials](/headers/access-control-allow-credentials): Indicates whether the response can be exposed when the CORS request includes credentials.
- [Access-Control-Allow-Headers](/headers/access-control-allow-headers): Lists the request headers that are permitted during the actual CORS request.
- [Access-Control-Allow-Methods](/headers/access-control-allow-methods): Lists the HTTP methods permitted when accessing a resource in response to a CORS preflight.
- [Access-Control-Allow-Origin](/headers/access-control-allow-origin): Specifies which origin(s) are permitted to read the response in a CORS request.
- [Access-Control-Expose-Headers](/headers/access-control-expose-headers): Lists the response headers that browsers are allowed to expose to client-side JavaScript.
- [Access-Control-Max-Age](/headers/access-control-max-age): Specifies how long the results of a CORS preflight request can be cached by the browser.
- [Access-Control-Request-Headers](/headers/access-control-request-headers): Sent by the browser in a CORS preflight to announce the custom headers of the actual request.
- [Access-Control-Request-Method](/headers/access-control-request-method): Sent by the browser in a CORS preflight to announce the method of the actual request.
- [Age](/headers/age): The time in seconds since a cached response was generated at the origin server.
- [Allow](/headers/allow): Lists the HTTP methods supported by the target resource, on a 405 Method Not Allowed or a 2xx OPTIONS response.
- [Authorization](/headers/authorization): Contains the credentials to authenticate the client with the server.
- [Cache-Control](/headers/cache-control): Directives for caching mechanisms in both requests and responses.
- [Content-Disposition](/headers/content-disposition): Indicates whether the body should be displayed inline or treated as a downloadable attachment.
- [Content-Encoding](/headers/content-encoding): Indicates the compression encoding that has been applied to the message body.
- [Content-Language](/headers/content-language): Describes the natural language(s) of the intended audience for the message body.
- [Content-Length](/headers/content-length): Indicates the size of the request or response body in bytes.
- [Content-Range](/headers/content-range): Indicates which portion of a resource is delivered in a partial response.
- [Content-Type](/headers/content-type): Indicates the media type of the request or response body payload.
- [Cookie](/headers/cookie): Sends previously stored cookies from the client back to the server.
- [Deprecation](/headers/deprecation): Signals that a resource is deprecated, carrying the date deprecation takes or took effect as a Structured Field Date.
- [ETag](/headers/etag): An identifier for a specific version of a resource, used for cache validation.
- [Expect](/headers/expect): Signals that the client expects a particular server behavior before continuing the request.
- [Expires](/headers/expires): The absolute date and time after which a cached response is considered stale.
- [Host](/headers/host): Specifies the target host and port of the resource being requested.
- [Idempotency-Key](/headers/idempotency-key): Custom request header used to prevent duplicate operations (mutations) on the server.
- [If-Match](/headers/if-match): Makes the request conditional; execution occurs only if the client ETag matches the server ETag.
- [If-Modified-Since](/headers/if-modified-since): Makes the request conditional; execution occurs only if the resource has changed since the given date.
- [If-None-Match](/headers/if-none-match): Makes the request conditional; execution occurs only if the client ETag does not match the server ETag.
- [Last-Modified](/headers/last-modified): The date and time a resource was last changed, used for cache validation.
- [Link](/headers/link): Provides a means to serialize relationships between resources in HTTP headers, commonly used for pagination.
- [Location](/headers/location): Indicates the URL to redirect the client to, or the URL of a newly created resource.
- [Origin](/headers/origin): Indicates the origin (scheme, host, and port) that a cross-origin request comes from.
- [Prefer](/headers/prefer): Lets the client request optional, non-critical handling behaviors from the server.
- [Range](/headers/range): Requests only part of a resource by specifying one or more byte ranges.
- [RateLimit-Limit](/headers/ratelimit-limit): Indicates the maximum number of requests the client is permitted to make in the current rate window.
- [RateLimit-Remaining](/headers/ratelimit-remaining): Indicates the remaining number of requests the client is allowed to make in the current rate window.
- [RateLimit-Reset](/headers/ratelimit-reset): Indicates the number of seconds remaining until the current rate window resets.
- [Retry-After](/headers/retry-after): Tells the client how long to wait before making a follow-up request.
- [Set-Cookie](/headers/set-cookie): Instructs the client to store a cookie and return it on subsequent requests.
- [Sunset](/headers/sunset): The date after which a resource is expected to become unavailable.
- [Vary](/headers/vary): Lists the request headers a response depends on, controlling cache key selection.
- [WWW-Authenticate](/headers/www-authenticate): Defines the authentication method that should be used to gain access to the resource.

### Request Methods
- [CONNECT](/methods/connect): Establishes a tunnel to the server identified by the target resource, typically through a proxy.
- [COPY](/methods/copy): Copies a resource from its current location to the URI given in the Destination header, in WebDAV.
- [DELETE](/methods/delete): Deletes the specified resource.
- [GET](/methods/get): Requests a representation of the specified resource. Requests using GET should only retrieve data.
- [HEAD](/methods/head): Asks for a response identical to a GET request, but without the response body.
- [LOCK](/methods/lock): Takes out a lock on a resource to prevent conflicting changes, in WebDAV.
- [MKCOL](/methods/mkcol): Creates a new collection resource at the specified location in WebDAV.
- [MOVE](/methods/move): Moves or renames a resource to the URI given in the Destination header, in WebDAV.
- [OPTIONS](/methods/options): Describes the communication options for the target resource.
- [PATCH](/methods/patch): Applies partial modifications to a resource.
- [POST](/methods/post): Submits an entity to the specified resource, often causing a change in state or side effects on the server.
- [PROPFIND](/methods/propfind): Retrieves properties defined on a resource, and optionally its member resources, in WebDAV.
- [PROPPATCH](/methods/proppatch): Sets or removes properties on a resource atomically in WebDAV.
- [PUT](/methods/put): Replaces all current representations of the target resource with the request payload.
- [QUERY](/methods/query): A proposed safe, idempotent method for sending a query as a request body, for cases where GET's URI-only constraints are impractical. Still an IETF Internet-Draft, not yet an RFC.
- [SEARCH](/methods/search): Runs a server-side query described in the request body against a resource, in WebDAV.
- [TRACE](/methods/trace): Performs a message loop-back test along the path to the target resource for diagnostics.
- [UNLOCK](/methods/unlock): Removes a lock from a resource using the supplied lock token, in WebDAV.

### Developer Guides
- [Agent-Ready API Checklist](/guides/agent-ready-checklist): A review checklist for an existing API and its webhooks, covering the contract, errors, idempotency, deprecation, delivery and enforcement. Written for consumers that cannot ask you a question.
- [API Authentication Schemes](/guides/authentication): A guide to HTTP-level authentication standards including Basic Auth, Bearer Tokens, and Message Signatures.
- [API Deprecation & Sunsetting](/guides/deprecation-sunsetting): Signaling API retirement with the Deprecation (RFC 9745) and Sunset (RFC 8594) headers, Link relations, and migration timelines.
- [API Rate Limiting](/guides/rate-limiting): How token bucket, sliding window, and fixed window algorithms work, and how to communicate limits with headers.
- [API Security Best Practices](/guides/api-security): A practical checklist for securing HTTP APIs: TLS, authentication versus authorization, the OWASP API Security Top 10, input validation, rate limiting, and least privilege.
- [API Versioning Strategies](/guides/versioning): Compare URI, Header, and Date-based versioning methods, and how to safely deprecate endpoints.
- [Asynchronous & Long-Running Operations](/guides/async-operations): Handle long-running work in HTTP APIs with 202 Accepted, status polling endpoints, job resources, Retry-After, and the trade-off between polling and webhooks.
- [Authorization Models: RBAC & ABAC](/guides/authorization-models): How to choose and combine RBAC, ABAC, and ReBAC, apply least privilege, and prevent object-level authorization failures like BOLA.
- [Bulk & Batch Operations](/guides/bulk-operations): How to design batch endpoints, handle partial success, and process bulk writes idempotently and asynchronously.
- [Cache Invalidation Strategies](/guides/cache-invalidation): A practical comparison of TTL, event-based, tag-based, and versioned invalidation, plus stale-while-revalidate and stale-if-error.
- [CDN & Edge Caching for APIs](/guides/cdn-edge-caching): How to control shared caches with s-maxage, Vary, surrogate keys, and stale-while-revalidate to serve API responses from the edge.
- [Conditional Requests & Validation](/guides/conditional-requests): How to use ETag, Last-Modified, and precondition headers to enable 304 responses and prevent lost updates in HTTP APIs.
- [Content Negotiation & Media Types](/guides/content-negotiation): Learn how content negotiation works in REST APIs, media types, and standard vendor extensions.
- [Cross-Origin Resource Sharing (CORS)](/guides/cors): Understand CORS, preflight OPTIONS requests, and access control headers in web APIs.
- [File Uploads & Downloads](/guides/file-uploads-downloads): Multipart uploads, presigned and resumable uploads, Range requests, Content-Disposition, and streaming.
- [Filtering, Sorting & Searching](/guides/filtering-sorting-searching): Query parameter conventions for filtering, sorting, and full-text search, including operators, pagination interplay, and when to move complex queries to a request body.
- [HATEOAS & Hypermedia APIs](/guides/hateoas): How hypermedia controls make REST APIs self-describing through links in responses, the HAL and JSON:API formats, and an honest look at why adoption is limited.
- [Health Checks & Status Endpoints](/guides/health-checks): Design liveness, readiness, and startup checks with the health+json format, dependency probes, and status pages.
- [How an API Becomes Tool Definitions](/guides/tool-definitions): What an agent actually receives when your OpenAPI document is converted into tool definitions, which parts of the contract survive the conversion, and which are silently dropped.
- [HTTP Caching & Conditional Requests](/guides/caching): A developer guide on HTTP caching headers (Cache-Control, ETag) and conditional requests (If-Match, If-None-Match).
- [HTTP Compression](/guides/compression): How APIs negotiate and apply gzip, Brotli, and Zstandard compression, and the caching and security considerations involved.
- [Idempotency & Request Retries](/guides/idempotency): How to implement idempotency keys, Redis-based locking, and safe client retry logic.
- [Input Validation & Injection Prevention](/guides/input-validation): Server-side schema validation, allowlisting, and canonicalization, plus defenses against SQL/NoSQL/command injection and mass assignment.
- [Internationalization & Localization](/guides/internationalization): How REST APIs negotiate language, separate message localization from data formatting, and standardize timestamps for a global audience.
- [Media Types & Vendor Content Types](/guides/media-types): How media types structure content, how the vendor tree and +json suffix work, and how to version APIs through the Accept header.
- [mTLS & Client Certificates](/guides/mutual-tls): How mutual TLS authenticates both sides of an API connection, when to use it over bearer tokens, and how to manage certificate rotation and validation.
- [Multi-Tenancy Patterns](/guides/multi-tenancy): Design multi-tenant APIs with silo, pool, and bridge isolation, tenant routing, noisy-neighbor mitigation, and verified tenant claims.
- [OAuth 2.0 & API Keys](/guides/oauth-api-keys): How API key authentication compares to OAuth 2.0, and when to use client credentials versus authorization code with PKCE.
- [Observability & Distributed Tracing](/guides/observability-tracing): Make your API debuggable in production with structured logging, RED and USE metrics, W3C Trace Context, correlation IDs, and OpenTelemetry.
- [Pagination Patterns (Offset vs. Cursor)](/guides/pagination): Detailed guide comparing offset and cursor pagination, detailing how to implement cursors and hypermedia headers.
- [PATCH Strategies: JSON Patch vs Merge Patch](/guides/patch-strategies): Comparing JSON Patch and JSON Merge Patch for partial resource updates, including null semantics and media types.
- [Request Signing](/guides/request-signing): Signing outbound API requests with HMAC, AWS SigV4-style canonical requests, signed headers, body digests, and clock-skew handling.
- [Resource Naming & URI Design](/guides/resource-naming): Conventions for naming resources and designing clean URIs: nouns over verbs, plural collections, sensible nesting, kebab-case, and path versus query parameters.
- [Response Envelope Design](/guides/response-envelopes): Weigh wrapping responses in data/meta/errors envelopes against bare bodies, and place pagination and error metadata consistently.
- [REST API Design Principles](/guides/rest-principles): The core constraints of REST: resources, statelessness, the uniform interface, correct verbs and status codes, and the Richardson Maturity Model.
- [Retries, Backoff & Resilience](/guides/retries-backoff): Idempotent retries, exponential backoff with jitter, honoring Retry-After, circuit breakers, and timeouts.
- [Sparse Fieldsets & Partial Responses](/guides/sparse-fieldsets): Let clients request only the fields they need with sparse fieldsets, and expand related resources on demand to reduce payload size and round trips.
- [Standardized Error Handling](/guides/error-handling): Designing centralized error dictionaries, parsing field-level validation errors, and structure guidelines.
- [Streaming APIs: SSE, WebSocket & Long-Polling](/guides/streaming-apis): Compare Server-Sent Events, WebSocket, and long-polling, with guidance on reconnection, scaling, and when to use each.
- [Timestamps & Data Formats](/guides/timestamps-and-formats): Conventions for representing time, money, enums, and nullability in JSON APIs: RFC 3339, always UTC, integer money, and consistent, unambiguous formats.
- [Token Lifecycle: Rotation, Refresh & Revocation](/guides/token-lifecycle): Managing the full life of API tokens: short-lived access tokens, single-use refresh token rotation, revocation, introspection, and JWKS key rotation.
- [Webhook Delivery History](/guides/webhook-delivery-history): Why recording the current state of a webhook delivery is not the same as recording its history, what each attempt should store, and how to make the record useful to the customer rather than only to you.
- [Webhook Signature Verification](/guides/webhook-signatures): How to verify incoming webhooks with HMAC-SHA256 signatures, signing secrets, timestamp-based replay protection, and constant-time comparison.
- [Webhooks & Event-Driven API Design](/guides/webhooks): Best practices for webhooks, covering secure payload signing, retry scheduling, receiver idempotency, and typed payloads whose changes are new event types rather than quiet mutations.
- [What Counts as a Breaking Change](/guides/breaking-changes): Why the contract is what consumers observe rather than what you documented, which additive changes still break clients, and why fixing a bug can be a breaking change.

### Specifications
- [Arazzo Specification](/specifications/arazzo): A comprehensive, multi-section breakdown of the Arazzo specification, explaining workflows orchestration, input-output expressions, and state assertions.
- [AsyncAPI Specification](/specifications/asyncapi): A deep-dive explanation of the AsyncAPI Specification, detailing message-driven architectures, channels, protocols, and event bindings.
- [CloudEvents](/specifications/cloudevents): An overview of the CloudEvents specification, the CNCF standard for describing event data in a common, vendor-neutral format.
- [GraphQL](/specifications/graphql): A query and schema definition language specification for APIs, providing a client-specified runtime to request exact data shapes.
- [gRPC & Protocol Buffers](/specifications/grpc): A high-performance, open-source universal RPC framework using Protocol Buffers as its interface definition and serialization language.
- [HAL (Hypertext Application Language)](/specifications/hal): A reference for the Hypertext Application Language, a simple hypermedia format for JSON and XML APIs, covering _links, curies, _embedded resources, and a comparison with JSON:API.
- [HTTP Caching (RFC 9111)](/specifications/http-caching): A reference guide to HTTP caching as defined in RFC 9111, covering freshness, validation, Cache-Control directives, the Vary header, shared versus private caches, and heuristic freshness.
- [HTTP Semantics (RFC 9110)](/specifications/http-semantics): The foundational reference for HTTP, RFC 9110 defines the version-independent semantics of the protocol: methods, status codes, header fields, representations, content negotiation, conditional and range requests, and the authentication framework.
- [HTTP/2 (RFC 9113)](/specifications/http2): A reference guide to HTTP/2 as defined in RFC 9113, covering binary framing, multiplexed streams over a single connection, HPACK header compression, stream prioritization, and the transport-layer head-of-line blocking that HTTP/3 later addressed.
- [HTTP/3 (RFC 9114)](/specifications/http3): A reference guide to HTTP/3 as defined in RFC 9114, the version of HTTP that runs over QUIC to eliminate transport-layer head-of-line blocking, with QPACK header compression, 0-RTT, connection migration, and Alt-Svc discovery.
- [JSON Schema in Web APIs](/specifications/json-schema): An authoritative guide to JSON Schema, detailing validation vocabulary, conditional schemas, logical operators, and $ref definition resolving.
- [JSON Web Token (JWT)](/specifications/jwt): A technical reference for JSON Web Tokens, covering the header/payload/signature structure, registered claims, JWS versus JWE, signing algorithms, and common validation pitfalls.
- [JSON-LD & Hydra](/specifications/json-ld-hydra): A reference for JSON-LD linked data and the Hydra vocabulary, covering @context, @id, @type, hypermedia-driven operations and collections, and a comparison with HAL and JSON:API.
- [JSON:API Specification](/specifications/json-api): A detailed breakdown of the JSON:API specification, explaining compounds documents, relations, sparse fieldsets, sorting, and pagination models.
- [OData (Open Data Protocol)](/specifications/odata): An overview of the OData specification, covering standardized query conventions, resource modeling, and where it fits alongside ad-hoc REST APIs.
- [OpenAPI Specification (OAS)](/specifications/openapi): A comprehensive, multi-section guide to the OpenAPI Specification (OAS), detailing root structures, paths, component registries, and version diffs.
- [OpenID Connect (OIDC)](/specifications/openid-connect): A reference for OpenID Connect, the identity layer on top of OAuth 2.0, covering the ID Token, the authorization code flow with PKCE, the UserInfo endpoint, discovery, and standard scopes.
- [Problem Details for HTTP APIs (RFC 9457)](/specifications/problem-details): A reference for the application/problem+json format, covering the standard members, extension members, and validation error patterns used to communicate HTTP API errors.
- [SCIM (System for Cross-domain Identity Management)](/specifications/scim): A reference for SCIM 2.0, the standard protocol for automating user and group provisioning across identity providers and applications, covering the core schema, resource endpoints, PATCH operations, and filtering.
- [Server-Sent Events (SSE)](/specifications/server-sent-events): A practical guide to Server-Sent Events, the HTML standard for one-way server-to-client streaming over a single long-lived HTTP connection using the text/event-stream media type.
- [WebSocket Protocol](/specifications/websocket): A reference guide to the WebSocket Protocol defined in RFC 6455, covering the HTTP Upgrade handshake, full-duplex framing, subprotocols, and how it compares to SSE and HTTP polling.

### API Tooling
- [Apigee (Google Cloud)](/tools/gateways-management/apigee): An enterprise-grade API gateway and management platform providing security, analytics, and developer portal tools.
- [AsyncAPI Specification](/tools/design-documentation/asyncapi): An open-source specification format used to design, document, and manage event-driven APIs.
- [AWS API Gateway](/tools/gateways-management/aws-api-gateway): A fully managed service enabling developers to publish, maintain, and secure APIs at any scale in AWS.
- [Bruno](/tools/clients-debugging/bruno): A fast, git-friendly open-source API client that stores collections directly as folder structures.
- [Charles Proxy](/tools/clients-debugging/charles-proxy): An HTTP proxy and monitor that enables developers to view and inspect all HTTP traffic between their machine and the internet.
- [curl](/tools/clients-debugging/curl): The ubiquitous command-line tool and library for transferring data with URLs using HTTP, HTTPS, and dozens of protocols.
- [Datadog APM](/tools/observability/datadog): An observability platform providing deep infrastructure monitoring, application performance monitoring (APM), and API log tracking.
- [Dynatrace APM](/tools/observability/dynatrace): Enterprise APM providing automatic service discovery, full-stack tracing, and AI-driven diagnostic alerts.
- [Fiddler (Progress)](/tools/clients-debugging/fiddler): A classic debugging proxy for routing, decrypting, and rewriting HTTP traffic.
- [gRPC / Protocol Buffers](/tools/design-documentation/grpc-protobuf): A high-performance RPC framework and binary serialization protocol developed by Google.
- [Hoppscotch](/tools/clients-debugging/hoppscotch): An open-source, browser-based API client for building and testing HTTP, GraphQL, WebSocket, and other requests, with a self-hostable option.
- [HTTPie](/tools/clients-debugging/httpie): A command-line HTTP client built for developers, offering clean syntax, syntax highlighting, and auto-formatted JSON.
- [Insomnia](/tools/clients-debugging/insomnia): A streamlined, desktop-based HTTP, REST, and GraphQL client built for local debugging and testing.
- [k6 (by Grafana)](/tools/testing-mocking/k6): A developer-centric load and performance testing tool scripted in JavaScript and executed in Go.
- [Kong Gateway](/tools/gateways-management/kong): A cloud-native, high-performance API gateway built on Nginx, serving as a centralized proxy for routing and security.
- [KrakenD](/tools/gateways-management/krakend): An ultra-performant, stateless API gateway built in Go, designed to handle large-scale routing without database dependencies.
- [legible](/tools/design-documentation/legible): An OpenAPI linter that scores how well a specification survives conversion into agent tool definitions, and explains every finding.
- [mitmproxy](/tools/clients-debugging/mitmproxy): An interactive, SSL-capable intercepting HTTP proxy CLI and web tool built for developers.
- [Mockoon](/tools/testing-mocking/mockoon): An easy-to-use local desktop mock server generator featuring a graphical interface.
- [Moesif](/tools/observability/moesif): A user-centric API analytics and monetization platform designed for debugging, monitoring, and billing.
- [New Relic](/tools/observability/new-relic): A comprehensive APM and cloud monitoring tool providing real-time telemetry, transaction tracing, and alert configurations.
- [Newman](/tools/testing-mocking/newman): A command-line collection runner for Postman, allowing tests to be integrated directly into CI/CD pipelines.
- [OpenAPI / Swagger](/tools/design-documentation/openapi-swagger): The industry-standard specification format for describing, designing, and documenting RESTful APIs.
- [Optic](/tools/testing-mocking/optic): Automates API contract testing by tracking changes, catching breaking changes, and verifying documentation accuracy.
- [Pact](/tools/testing-mocking/pact): A consumer-driven contract testing framework that lets services verify their integrations without spinning up full end-to-end environments.
- [Postman](/tools/testing-mocking/postman): A comprehensive API platform for building, testing, organizing, and collaborating on HTTP requests.
- [Prism (Stoplight)](/tools/testing-mocking/prism): An open-source mock server that parses OpenAPI specifications and runs mock API endpoints.
- [Prometheus & Grafana](/tools/observability/prometheus-grafana): The standard open-source time-series DB and dashboarding stack for API infrastructure metrics.
- [Redoc (Redocly)](/tools/design-documentation/redocly): Generates clean, responsive, and highly readable API reference documentation from OpenAPI specifications.
- [Sentry](/tools/observability/sentry): An open-source error tracking and performance monitoring platform helping developers debug errors in real-time.
- [SoapUI](/tools/testing-mocking/soapui): A functional testing application for SOAP and REST APIs, designed for testing complex enterprise integrations.
- [Spectral (Stoplight)](/tools/design-documentation/spectral-stoplight): A flexible, JSON/YAML linter for checking API designs against custom style rules and OpenAPI standards.
- [Tyk](/tools/gateways-management/tyk): An open-source, enterprise-grade API gateway and management platform built in Go.
- [WireMock](/tools/testing-mocking/wiremock): A simulator for HTTP-based APIs, enabling developers to mock downstream dependencies in integration tests.
- [Zuplo](/tools/gateways-management/zuplo): A serverless API gateway built for developers, offering git-ops workflows, rate limiting, and instant documentation.