REST API Design

This article is a glossary entry on the topic of REST API Design – including exam questions, core components, and tags.

In a Nutshell

REST is an architectural style for web services that uses resource-oriented design and HTTP methods to create scalable interfaces.

Compact Technical Description

REST (Representational State Transfer) is based on six constraints (including client-server separation, stateless communication). Resources are addressed via URIs and transferred via representations (JSON/XML). HTTP methods (GET, POST, PUT, DELETE) map to CRUD operations. HATEOAS can make APIs “navigable”. Performance is optimized through caching and pagination, among other approaches.

Exam-Relevant Key Points

• Richardson Maturity Model for assessing API quality
• Idempotency of PUT vs. POST
• HATEOAS as a hypermedia principle
• Security through OAuth 2.0 and HTTPS
• Versioning via URI or header

Core Components

1. Resources (URI design)
2. HTTP methods (GET, POST, PUT, DELETE)
3. Status codes (200, 201, 400, 401, 404, 500)
4. Media formats (JSON, XML)
5. Security mechanisms (HTTPS, OAuth)

Practical Example (User Management API)

Resources:
/users
/users/{id}

GET /users?page=1
POST /users
PUT /users/{id}
DELETE /users/{id}

Advantages and Disadvantages

Advantages	Disadvantages
Easy integration	Complex error handling
Reusability	Difficult to use without documentation
Scalability	Overfetching with large resources

Top Exam Questions (with Short Answer)

1. Which HTTP method is idempotent but not safe? PUT.
2. How do you prevent overfetching? Through specific query parameters (or alternative approaches like GraphQL).
3. Three security risks in REST APIs? Broken Authentication, Mass Assignment, Injection.
4. What does HATEOAS mean? Hypermedia As The Engine Of Application State – links control navigation.
5. How do you document REST APIs? With OpenAPI (Swagger).

Glossary

Term	Definition
Idempotency	Multiple execution has the same effect as executing once
HATEOAS	Hypermedia-based navigation between resources
OAuth 2.0	Authorization framework for delegated access

Topic Analysis

• Technical core: HTTP protocol, resource modeling
• Implementation challenges: consistent URI design, error handling
• Security implications: authentication, encryption
• Documentation requirements: OpenAPI specification
• Economic assessment: reuse reduces development costs

Learning Strategy

1. Understanding entry: Analyze a familiar API (e.g., GitHub REST API).
2. Deepening method: Write a small OpenAPI specification (address book).
3. Exam focus training: Design a product API in 15 minutes.
4. Error prevention: Check security with OWASP ZAP.

Most Important Sources

1. https://swagger.io/specification/
2. https://owasp.org/www-project-api-security/
3. https://docs.github.com/rest
4. https://www.postman.com/api-examples/