REST, auth, security, best practices
/users/:id Read a resource. Idempotent. Cacheable. /users Create a resource. Not idempotent. /users/:id Full replace. Idempotent. /users/:id Partial update. May not be idempotent. /users/:id Remove resource. Idempotent. 200 OK 201 Created 204 No Content 301 Moved Permanently 304 Not Modified 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 409 Conflict 422 Unprocessable Entity 429 Too Many Requests 500 Internal Server Error 502 Bad Gateway 503 Service Unavailable Stateless token. Header.Payload.Signature (HMAC/RSA)
Server-side session ID in cookie
Authorization code → access token → refresh token
Static key in header/query param
Offset: ?page=2&limit=20 Cursor: ?cursor=abc123&limit=20 (preferred) Keyset: ?after_id=100&limit=20 URL: /api/v1/users Header: Accept: application/vnd.api+json;version=1 Query: ?version=1 X-RateLimit-Limit: 100 X-RateLimit-Remaining: 95 X-RateLimit-Reset: 1620000000 429 when exceeded { "error": { "code": "VALIDATION_ERROR", "message": "Email is required", "details": [...] } }