Partialdependentassociativelinked/companies/{id} and /company/company/{id} and /companies/companies/{id} and /companies/company/{id} and /companydata in the tokenOwnershipa permissionand integerUniform InterfaceClient-ServerStatelessChacheableHTTPRESTOPTIONSCORSnotify other systems of an eventcatch error fasterimprove error logginglog additional datato add new technologies to an organization's infrastructure.to share features and functionality with other system.to move infrastructure to the cloud.to appease the latest digital transformation effort.bashcurlsshpowerShellOpenAPI (Swagger)WADLWSDLOAuthSUBMITWRITEPOSTCREATEMobile app work better.It improves uptime.It offers better security.It reduce load on servers.409 Conflict400 Bad Request406 Not Acceptable405 Method Not Allowedan identify layer on top of OAuth 2.0the new name for SAML 3.0a modern replacement for API keysan SSO competitor for OAuth 2.0flexible querying/responsesmore stable APIscompatible with more gatewaysmore secure by defaultStatelessClient-ServerUniform InterfaceCacheableIt identifies the user ID.It identifies the client application or SDK.It identifies if the API should expect a user authentication.It identifies if the API should accept microservice traffic.application/jsonapplication/json_version2text/htmlapplication/vnd.myapp.v2+jsonA token is encrypted.A token is encoded.A token is scoped to the use case.A token can be shared between systems.How to easily secure your APIs with API keys and OAuth
stateless architectureidempotencya uniform interfacecacheabilityAPI proxyAPI gatewayOpenAPIOAuth authorization servertransport over SSLencrypted payloada signatureencoded payloadtokenscopeclaimback channelID tokenrefresh tokenaccess tokenauth code tokenno-proxyclient-onlyrestrictedprivateAuthorization Code GrantClient Credentials GrantImplicit GrantAuthentication GrantIt varies from API to API.adminwriteread-write_embeddedresourcessubresources_linkstracking downloadsAccept headersuser agentspolling usersLayered SystemStatelessClient-ServerCacheableyour tech stackreasoning for your naming schemayour mission statementsample codeResponse TimeTime to First Hello WorldTTLUptimeGET /user/{id}GET /users/{id}GET /user?id={id}GET /users?id={id}to describe relationships between resources or actionsto describe subresources related to the current oneto link two resources togetherto describe a resource and its purposeresources_embeddedsubresources_linksAPI gatewayAPI logging a layered system API proxycommon knowledgeURLsno versioningthe Accept headerURL parameterAuthorization headerBase64 encodingBasic Authclientnot specifiedauthorization serverresource serverinbound trafficnorth-south traffic internal traffic east-west trafficAdd .json to the URL.APIs do not use XML.Use the Content-Type header.Use the Accept header.403404401405HTTP verbsJSON payloadsHTTP response codesrate limiting/throttlingred team testingwhite box testingblue box testingblack box testingPUTPOSTGETOPTIONSExpires: 1 minuteCache-Control: max-age=60Expires: 1 January 2020Cache-Expires: max-age=60hypermedialink relationsparsingbrowsing405201204202REST Architectural Constraints
A. The exp (expiration) has not passed.
B. The algorithm is sufficient.
C. The signature matches the payload.
D. The token was Base64 encoded.
E. The iss (issuer) is the auth server you expect.
F. There is a refresh token.
G. The cid (client ID) is the client you expect.
H. The token was encrypted.
east-west trafficinbound trafficnorth-south trafficexternal trafficNorth-South vs East-West Traffic
OAuth 2.0 for Native and Mobile Apps
YY-M-D hh:mm:ss+TZYY-M-D h:mm:ssYYYY-MM-DDThh:mm:ssZYYYY-M-D hh:mm:ssThe 5 laws of API dates and times
Cache-Control Expires Etag Rate limiting your RESTful API
RETRIEVEFORMGETREAD200405201204