Developer Guides & specifications

A practical checklist for securing HTTP APIs: TLS, authentication versus authorization, the OWASP API Security Top 10, input validation, rate limiting, and least privilege.

Handle long-running work in HTTP APIs with 202 Accepted, status polling endpoints, job resources, Retry-After, and the trade-off between polling and webhooks.

A guide to HTTP-level authentication standards including Basic Auth, Bearer Tokens, and Message Signatures.

How to choose and combine RBAC, ABAC, and ReBAC, apply least privilege, and prevent object-level authorization failures like BOLA.

How to design batch endpoints, handle partial success, and process bulk writes idempotently and asynchronously.

A practical comparison of TTL, event-based, tag-based, and versioned invalidation, plus stale-while-revalidate and stale-if-error.

A developer guide on HTTP caching headers (Cache-Control, ETag) and conditional requests (If-Match, If-None-Match).

How to control shared caches with s-maxage, Vary, surrogate keys, and stale-while-revalidate to serve API responses from the edge.

How APIs negotiate and apply gzip, Brotli, and Zstandard compression, and the caching and security considerations involved.

How to use ETag, Last-Modified, and precondition headers to enable 304 responses and prevent lost updates in HTTP APIs.

Learn how content negotiation works in REST APIs, media types, and standard vendor extensions.

Understand CORS, preflight OPTIONS requests, and access control headers in web APIs.

Signaling API retirement with the Deprecation (RFC 9745) and Sunset (RFC 8594) headers, Link relations, and migration timelines.

Designing centralized error dictionaries, parsing field-level validation errors, and structure guidelines.

Multipart uploads, presigned and resumable uploads, Range requests, Content-Disposition, and streaming.

Query parameter conventions for filtering, sorting, and full-text search, including operators, pagination interplay, and when to move complex queries to a request body.

How hypermedia controls make REST APIs self-describing through links in responses, the HAL and JSON:API formats, and an honest look at why adoption is limited.

Design liveness, readiness, and startup checks with the health+json format, dependency probes, and status pages.

How to implement idempotency keys, Redis-based locking, and safe client retry logic.

Server-side schema validation, allowlisting, and canonicalization, plus defenses against SQL/NoSQL/command injection and mass assignment.

How REST APIs negotiate language, separate message localization from data formatting, and standardize timestamps for a global audience.

How media types structure content, how the vendor tree and +json suffix work, and how to version APIs through the Accept header.

Design multi-tenant APIs with silo, pool, and bridge isolation, tenant routing, noisy-neighbor mitigation, and verified tenant claims.

How mutual TLS authenticates both sides of an API connection, when to use it over bearer tokens, and how to manage certificate rotation and validation.

How API key authentication compares to OAuth 2.0, and when to use client credentials versus authorization code with PKCE.

Make your API debuggable in production with structured logging, RED and USE metrics, W3C Trace Context, correlation IDs, and OpenTelemetry.

Detailed guide comparing offset and cursor pagination, detailing how to implement cursors and hypermedia headers.

Comparing JSON Patch and JSON Merge Patch for partial resource updates, including null semantics and media types.

How token bucket, sliding window, and fixed window algorithms work, and how to communicate limits with headers.

Signing outbound API requests with HMAC, AWS SigV4-style canonical requests, signed headers, body digests, and clock-skew handling.

Conventions for naming resources and designing clean URIs: nouns over verbs, plural collections, sensible nesting, kebab-case, and path versus query parameters.

Weigh wrapping responses in data/meta/errors envelopes against bare bodies, and place pagination and error metadata consistently.

The core constraints of REST: resources, statelessness, the uniform interface, correct verbs and status codes, and the Richardson Maturity Model.

Idempotent retries, exponential backoff with jitter, honoring Retry-After, circuit breakers, and timeouts.

Let clients request only the fields they need with sparse fieldsets, and expand related resources on demand to reduce payload size and round trips.

Compare Server-Sent Events, WebSocket, and long-polling, with guidance on reconnection, scaling, and when to use each.

Conventions for representing time, money, enums, and nullability in JSON APIs: RFC 3339, always UTC, integer money, and consistent, unambiguous formats.

Managing the full life of API tokens: short-lived access tokens, single-use refresh token rotation, revocation, introspection, and JWKS key rotation.

Compare URI, Header, and Date-based versioning methods, and how to safely deprecate endpoints.

How to verify incoming webhooks with HMAC-SHA256 signatures, signing secrets, timestamp-based replay protection, and constant-time comparison.

Best practices for webhooks, including secure payload signing (HMAC) and retry scheduling.