Operate APIs, build your design skills.
Methods, status codes, auth flows, caching, and reliability — one HTTP guarantee at a time.
You can aim for: HTTP APIs (design & consumption)Try the API PlaygroundHTTP fundamentals
Request and Response Anatomy
Read a request and a response as the same sequence: first line, headers, blank line, body.
What HTTP Methods Mean
Classify GET, POST, PUT, PATCH, and DELETE as safe or unsafe, and idempotent or not.
Choosing a Status Code
Read a status code by its class, then choose the right 2xx or 4xx code for the situation.
What Headers Do
Understand what four key headers mean and how a server picks a response format.
The Parts of a URL
Understand each part of a URL, and when to use a path parameter versus a query parameter.
REST resource design
How to Name Endpoints
Name endpoints after the nouns they represent, not the actions performed on them.
CRUD and Method Mapping
Work out which method and URL express create, read, update, and delete.
Filtering, Sorting, and Choosing Fields
Adjust a collection's results with query parameters, without changing the resource itself.
Pagination
Compare offset and cursor pagination, and see why offsets skip or repeat rows.
How to Return Related Data
Decide whether to embed related data or return a reference, and see why deep nesting causes problems.
Designing Error Responses
Design machine-readable errors with application/problem+json (RFC 9457).
Authentication & authorization
Authentication vs. Authorization
Tell authentication from authorization, and see who checks each one.
API Keys
Learn how an API key is issued and verified, and why it shouldn't appear in a URL or repository.
Sessions vs. Tokens
Compare server-side sessions with self-contained tokens, and see how each behaves at scale.
JWT Structure and Verification
Understand the header.payload.signature structure and what verifying a JWT actually checks.
OAuth 2.0 Authorization Code Flow
Trace the four parties in the authorization code flow and what each hands to the next.
Scopes and Least Privilege
Limit what a token can do, and see the risk of granting more than needed.
Caching & conditional requests
When a Cache Can Reuse a Response
Understand Cache-Control directives and how a cache decides a response is fresh or stale.
Checking for Changes with ETag
Use ETag to check whether a response changed, and skip the body with 304 if it didn't.
Checking for Changes with Last-Modified
Check for changes by timestamp instead of by an opaque identifier.
Use Optimistic Locking to Not Overwrite Others' Changes
Use If-Match and 412 to stop a write from silently overwriting someone else's change.
Reliable requests
Use Idempotency Keys to Prevent Duplicate Requests
Make a POST safe to retry with a client-generated key that the server remembers.
Retrying Failed Requests
Retry failed requests with growing delays, and know which methods are safe to retry.
Rate Limiting
Understand 429, Retry-After, and the token bucket idea behind rate limits.
Webhooks
Understand how a server can call the client, and how to verify the call is genuine.
Three Ways to Get Updates Right Away
Compare long polling, SSE, and WebSocket by how the connection is held and which way data flows.
Comparing API styles
REST in Review
Review REST's three core commitments: resource orientation, HTTP's own semantics, and statelessness.
GraphQL
Understand GraphQL's single endpoint and client-chosen fields, and how it relates to overfetching and N+1.
gRPC
Understand what binary, schema-driven, and streaming mean, and when they're worth it.
Defining an API with OpenAPI
Understand contract-first development and what can be generated from an OpenAPI schema.
Versioning
Compare URL and header versioning, and design changes that don't need a new version.