際際滷

際際滷Share a Scribd company logo
Best Practices for
Designing a Pragmatic
RESTful API
Key requirements for the API
 It should use web standards where they make
sense
 It should be simple, intuitive and consistent
 It should be efficient, while maintaining balance
with the other requirements
The key principles of REST involve
separating your API into logical resources.
These resources are manipulated using
HTTP requests where the method (GET,
POST, PUT, PATCH, DELETE) has specific
meaning.
RESTful principles provide strategies to handle CRUD
actions using HTTP methods mapped as follows:
 GET /tickets - Retrieves a list of tickets
 GET /tickets/12 - Retrieves a specific ticket
 POST /tickets - Creates a new ticket
 PUT /tickets/12 - Updates ticket #12
 PATCH /tickets/12 - Partially updates ticket #12
 DELETE /tickets/12 - Deletes ticket #12
There are no method naming conventions to
follow and the URL structure is clean & clear.
But how do you deal with
relations?
 GET /tickets/12/messages - Retrieves list of messages for ticket
#12
 GET /tickets/12/messages/5 - Retrieves message #5 for ticket #12
 POST /tickets/12/messages - Creates a new message in ticket
#12
 PUT /tickets/12/messages/5 - Updates message #5 for ticket #12
 PATCH /tickets/12/messages/5 - Partially updates message #5 for
ticket #12
 DELETE /tickets/12/messages/5 - Deletes message #5 for ticket
#12
What about actions that
don't fit into the world of
CRUD operations?
 An activate action could be mapped to a boolean
activated field and updated via a PATCH to the
resource
 PUT /gists/:id/star and DELETE /gists/:id/star
 Just do what's right from the perspective of the
API consumer and make sure it's documented
clearly
 SSL
 Documentation
 Versioning
Result filtering, sorting &
searching
 GET /tickets?state=open - query parameter that
implements a filter
 GET /tickets?sort=-priority - Retrieves a list of
tickets in descending order of priority
 GET /tickets?q=return&state=open&sort=-
priority,created_at - Retrieve the highest priority
open tickets mentioning the word 'return'
Updates & creation
should return a resource
representation
JSON only responses
snake_case vs camelCase
An API that accepts JSON encoded POST, PUT & PATCH requests should
also require the Content-Type header be set to application/json or throw a
415 Unsupported Media Type HTTP status code.
JSON encoded POST, PUT & PATCH bodies
Rate limiting
 X-Rate-Limit-Limit - The number of allowed
requests in the current period
 X-Rate-Limit-Remaining - The number of
remaining requests in the current period
 X-Rate-Limit-Reset - The number of seconds left
in the current period
Errors
HTTP status codes
 200 OK - Response to a successful GET, PUT,
PATCH or DELETE. Can also be used for a
POST that doesn't result in a creation.
 201 Created - Response to a POST that results
in a creation. Should be combined with a
Location header pointing to the location of the
new resource
 204 No Content - Response to a successful
request that won't be returning a body (like a
DELETE request)
 400 Bad Request - The request is malformed,
such as if the body does not parse
 401 Unauthorized - When no or invalid
authentication details are provided. Also useful to
trigger an auth popup if the API is used from a
browser
 403 Forbidden - When authentication succeeded
but authenticated user doesn't have access to
the resource
 404 Not Found - When a non-existent resource is
requested
 405 Method Not Allowed - When an HTTP
method is being requested that isn't allowed for
the authenticated user
 429 Too Many Requests - When a request is
rejected due to rate limiting
THX
Ad

Recommended

Rest api and-crud-api
Rest api and-crud-api
F(x) Data Labs Pvt Ltd
API Design- Best Practices
API Design- Best Practices
Prakash Bhandari
Introduction to REST - API
Introduction to REST - API
Chetan Gadodia
introduction about REST API
introduction about REST API
AmilaSilva13
An Introduction To REST API
An Introduction To REST API
Aniruddh Bhilvare
REST API and CRUD
REST API and CRUD
Prem Sanil
REST API
REST API
Tofazzal Ahmed
Rest api standards and best practices
Rest api standards and best practices
Ankita Mahajan
REST API Design & Development
REST API Design & Development
Ashok Pundit
REST-API introduction for developers
REST-API introduction for developers
Patrick Savalle
Understanding and testing restful web services
Understanding and testing restful web services
mwinteringham
REST API Design
REST API Design
Devi Kiran G
Demystify Salesforce Bulk API
Demystify Salesforce Bulk API
Dhanik Sahni
What is an API?
What is an API?
Muhammad Zuhdi
Rest API
Rest API
Rohana K Amarakoon
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays
40+ tips to use Postman more efficiently
40+ tips to use Postman more efficiently
postmanclient
API Testing. Streamline your testing process.
API Testing. Streamline your testing process.
Andrey Oleynik
Knowledge of web ui for automation testing
Knowledge of web ui for automation testing
Artem Korchevyi
API Basics
API Basics
Ritul Chaudhary
Best Practices in Web Service Design
Best Practices in Web Service Design
Lorna Mitchell
L18 REST API Design
L18 REST API Design
lafur Andri Ragnarsson
Test in Rest. API testing with the help of Rest Assured.
Test in Rest. API testing with the help of Rest Assured.
Artem Korchevyi
Clean up this mess - API Gateway & Service Discovery in .NET
Clean up this mess - API Gateway & Service Discovery in .NET
Marcin Tyborowski
Web API testing : A quick glance
Web API testing : A quick glance
Dhanalaxmi K
The never-ending REST API design debate
The never-ending REST API design debate
Restlet
Learn REST in 18 際際滷s
Learn REST in 18 際際滷s
Suraj Gupta
Aws Technical Day 2015 - Amazon API Gateway
Aws Technical Day 2015 - Amazon API Gateway
aws-marketing-il
"Best Practices for Designing a Pragmatic RESTful API
"Best Practices for Designing a Pragmatic RESTful API
ITCP Community
REST API V2
REST API V2
仄亳亳亶 仂亶从仂

More Related Content

What's hot (20)

REST API Design & Development
REST API Design & Development
Ashok Pundit
REST-API introduction for developers
REST-API introduction for developers
Patrick Savalle
Understanding and testing restful web services
Understanding and testing restful web services
mwinteringham
REST API Design
REST API Design
Devi Kiran G
Demystify Salesforce Bulk API
Demystify Salesforce Bulk API
Dhanik Sahni
What is an API?
What is an API?
Muhammad Zuhdi
Rest API
Rest API
Rohana K Amarakoon
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays
40+ tips to use Postman more efficiently
40+ tips to use Postman more efficiently
postmanclient
API Testing. Streamline your testing process.
API Testing. Streamline your testing process.
Andrey Oleynik
Knowledge of web ui for automation testing
Knowledge of web ui for automation testing
Artem Korchevyi
API Basics
API Basics
Ritul Chaudhary
Best Practices in Web Service Design
Best Practices in Web Service Design
Lorna Mitchell
L18 REST API Design
L18 REST API Design
lafur Andri Ragnarsson
Test in Rest. API testing with the help of Rest Assured.
Test in Rest. API testing with the help of Rest Assured.
Artem Korchevyi
Clean up this mess - API Gateway & Service Discovery in .NET
Clean up this mess - API Gateway & Service Discovery in .NET
Marcin Tyborowski
Web API testing : A quick glance
Web API testing : A quick glance
Dhanalaxmi K
The never-ending REST API design debate
The never-ending REST API design debate
Restlet
Learn REST in 18 際際滷s
Learn REST in 18 際際滷s
Suraj Gupta
Aws Technical Day 2015 - Amazon API Gateway
Aws Technical Day 2015 - Amazon API Gateway
aws-marketing-il
REST API Design & Development
REST API Design & Development
Ashok Pundit
REST-API introduction for developers
REST-API introduction for developers
Patrick Savalle
Understanding and testing restful web services
Understanding and testing restful web services
mwinteringham
REST API Design
REST API Design
Devi Kiran G
Demystify Salesforce Bulk API
Demystify Salesforce Bulk API
Dhanik Sahni
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays LIVE India - REST the Events - REST APIs for Event-Driven Architectur...
apidays
40+ tips to use Postman more efficiently
40+ tips to use Postman more efficiently
postmanclient
API Testing. Streamline your testing process.
API Testing. Streamline your testing process.
Andrey Oleynik
Knowledge of web ui for automation testing
Knowledge of web ui for automation testing
Artem Korchevyi
Best Practices in Web Service Design
Best Practices in Web Service Design
Lorna Mitchell
Test in Rest. API testing with the help of Rest Assured.
Test in Rest. API testing with the help of Rest Assured.
Artem Korchevyi
Clean up this mess - API Gateway & Service Discovery in .NET
Clean up this mess - API Gateway & Service Discovery in .NET
Marcin Tyborowski
Web API testing : A quick glance
Web API testing : A quick glance
Dhanalaxmi K
The never-ending REST API design debate
The never-ending REST API design debate
Restlet
Learn REST in 18 際際滷s
Learn REST in 18 際際滷s
Suraj Gupta
Aws Technical Day 2015 - Amazon API Gateway
Aws Technical Day 2015 - Amazon API Gateway
aws-marketing-il

Similar to Rest API (20)

"Best Practices for Designing a Pragmatic RESTful API
"Best Practices for Designing a Pragmatic RESTful API
ITCP Community
REST API V2
REST API V2
仄亳亳亶 仂亶从仂
REST API Recommendations
REST API Recommendations
Jeelani Shaik
Rest APIs Training
Rest APIs Training
Shekhar Kumar
弌仂亰亟舒仆亳亠 API, 从仂仂仂亠 仗仂仍ミ英 舒亰舒弍仂亳从亳. 仍弍仂从仂亠 仗仂亞亢亠仆亳亠
弌仂亰亟舒仆亳亠 API, 从仂仂仂亠 仗仂仍ミ英 舒亰舒弍仂亳从亳. 仍弍仂从仂亠 仗仂亞亢亠仆亳亠
SQALab
REST Methodologies
REST Methodologies
jrodbx
Best Practices for Architecting a Pragmatic Web API.
Best Practices for Architecting a Pragmatic Web API.
Mario Cardinal
What is REST?
What is REST?
Saeid Zebardast
REST Api Tips and Tricks
REST Api Tips and Tricks
Maksym Bruner
The never-ending REST API design debate -- Devoxx France 2016
The never-ending REST API design debate -- Devoxx France 2016
Restlet
A Deep Dive into RESTful API Design Part 2
A Deep Dive into RESTful API Design Part 2
VivekKrishna34
Standards of rest api
Standards of rest api
Ma箪ur Chourasiya
Don't screw it up! How to build durable API
Don't screw it up! How to build durable API
Alessandro Cinelli (cirpo)
RESTful APIs in .NET
RESTful APIs in .NET
Greg Sohl
RefCard RESTful API Design
RefCard RESTful API Design
OCTO Technology
Rest WebAPI with OData
Rest WebAPI with OData
Mahek Merchant
Attacking REST API
Attacking REST API
Siddharth Bezalwar
RESTful Services
RESTful Services
Jason Gerard
Http and REST APIs.
Http and REST APIs.
Rahul Tanwani
API Design Antipatterns - APICon SF
API Design Antipatterns - APICon SF
Manish Pandit
"Best Practices for Designing a Pragmatic RESTful API
"Best Practices for Designing a Pragmatic RESTful API
ITCP Community
REST API Recommendations
REST API Recommendations
Jeelani Shaik
Rest APIs Training
Rest APIs Training
Shekhar Kumar
弌仂亰亟舒仆亳亠 API, 从仂仂仂亠 仗仂仍ミ英 舒亰舒弍仂亳从亳. 仍弍仂从仂亠 仗仂亞亢亠仆亳亠
弌仂亰亟舒仆亳亠 API, 从仂仂仂亠 仗仂仍ミ英 舒亰舒弍仂亳从亳. 仍弍仂从仂亠 仗仂亞亢亠仆亳亠
SQALab
REST Methodologies
REST Methodologies
jrodbx
Best Practices for Architecting a Pragmatic Web API.
Best Practices for Architecting a Pragmatic Web API.
Mario Cardinal
REST Api Tips and Tricks
REST Api Tips and Tricks
Maksym Bruner
The never-ending REST API design debate -- Devoxx France 2016
The never-ending REST API design debate -- Devoxx France 2016
Restlet
A Deep Dive into RESTful API Design Part 2
A Deep Dive into RESTful API Design Part 2
VivekKrishna34
Don't screw it up! How to build durable API
Don't screw it up! How to build durable API
Alessandro Cinelli (cirpo)
RESTful APIs in .NET
RESTful APIs in .NET
Greg Sohl
RefCard RESTful API Design
RefCard RESTful API Design
OCTO Technology
Rest WebAPI with OData
Rest WebAPI with OData
Mahek Merchant
RESTful Services
RESTful Services
Jason Gerard
Http and REST APIs.
Http and REST APIs.
Rahul Tanwani
API Design Antipatterns - APICon SF
API Design Antipatterns - APICon SF
Manish Pandit
Ad

Recently uploaded (20)

SAP_S4HANA_eCommerce_Integration_Presentation.pptx
SAP_S4HANA_eCommerce_Integration_Presentation.pptx
vemulavenu484
rosoft PowcgnggerPoint Presentation.pptx
rosoft PowcgnggerPoint Presentation.pptx
sirbabu778
IAREUOUSTPIDWHY$)CHARACTERARERWUEEJJSKWNSND
IAREUOUSTPIDWHY$)CHARACTERARERWUEEJJSKWNSND
notgachabite123
Unlocking Business Growth Through Targeted Social Engagement
Unlocking Business Growth Through Targeted Social Engagement
Digital Guider
AI theory work for students to understand the logic
AI theory work for students to understand the logic
areeba15775n
Quantiuwewe e3er14e we3223 32222 m2.pptx
Quantiuwewe e3er14e we3223 32222 m2.pptx
cyberesearchprof
ChatGPT A.I. Powered Chatbot and Popularization.pdf
ChatGPT A.I. Powered Chatbot and Popularization.pdf
StanleySamson1
Top Mobile App Development Trends Shaping the Future
Top Mobile App Development Trends Shaping the Future
ChicMic Studios
Topic 1 Foundational IT Infrastructure_.pptx
Topic 1 Foundational IT Infrastructure_.pptx
oneillp100
In order to install and use the device software, your computer must meet the ...
In order to install and use the device software, your computer must meet the ...
raguclc
AWS Basics for non technical people.pptx
AWS Basics for non technical people.pptx
sanjeevkumar123577
simple-presentationtestingdocument2007.pptx
simple-presentationtestingdocument2007.pptx
ashokjayapal
Topic 2 - Cloud Computing Basics,,,.pptx
Topic 2 - Cloud Computing Basics,,,.pptx
oneillp100
Fast Reroute in SR-MPLS, presented at bdNOG 19
Fast Reroute in SR-MPLS, presented at bdNOG 19
APNIC
The it.com Domains Brand Book for registrars, domain resellers and hosting co...
The it.com Domains Brand Book for registrars, domain resellers and hosting co...
it.com Domains
Dark Web Presentation - 1.pdf about internet which will help you to get to kn...
Dark Web Presentation - 1.pdf about internet which will help you to get to kn...
ragnaralpha7199
3 years of Quarkus in production, what have we learned - Devoxx Polen
3 years of Quarkus in production, what have we learned - Devoxx Polen
Jago de Vreede
cybercrime investigation and digital forensics
cybercrime investigation and digital forensics
goverdhankumar137300
Timeline Infographics Para utiliza巽達o di叩ria
Timeline Infographics Para utiliza巽達o di叩ria
meslellis
CBUSDAW - Ash Lewis - Reducing LLM Hallucinations
CBUSDAW - Ash Lewis - Reducing LLM Hallucinations
Jason Packer
SAP_S4HANA_eCommerce_Integration_Presentation.pptx
SAP_S4HANA_eCommerce_Integration_Presentation.pptx
vemulavenu484
rosoft PowcgnggerPoint Presentation.pptx
rosoft PowcgnggerPoint Presentation.pptx
sirbabu778
IAREUOUSTPIDWHY$)CHARACTERARERWUEEJJSKWNSND
IAREUOUSTPIDWHY$)CHARACTERARERWUEEJJSKWNSND
notgachabite123
Unlocking Business Growth Through Targeted Social Engagement
Unlocking Business Growth Through Targeted Social Engagement
Digital Guider
AI theory work for students to understand the logic
AI theory work for students to understand the logic
areeba15775n
Quantiuwewe e3er14e we3223 32222 m2.pptx
Quantiuwewe e3er14e we3223 32222 m2.pptx
cyberesearchprof
ChatGPT A.I. Powered Chatbot and Popularization.pdf
ChatGPT A.I. Powered Chatbot and Popularization.pdf
StanleySamson1
Top Mobile App Development Trends Shaping the Future
Top Mobile App Development Trends Shaping the Future
ChicMic Studios
Topic 1 Foundational IT Infrastructure_.pptx
Topic 1 Foundational IT Infrastructure_.pptx
oneillp100
In order to install and use the device software, your computer must meet the ...
In order to install and use the device software, your computer must meet the ...
raguclc
AWS Basics for non technical people.pptx
AWS Basics for non technical people.pptx
sanjeevkumar123577
simple-presentationtestingdocument2007.pptx
simple-presentationtestingdocument2007.pptx
ashokjayapal
Topic 2 - Cloud Computing Basics,,,.pptx
Topic 2 - Cloud Computing Basics,,,.pptx
oneillp100
Fast Reroute in SR-MPLS, presented at bdNOG 19
Fast Reroute in SR-MPLS, presented at bdNOG 19
APNIC
The it.com Domains Brand Book for registrars, domain resellers and hosting co...
The it.com Domains Brand Book for registrars, domain resellers and hosting co...
it.com Domains
Dark Web Presentation - 1.pdf about internet which will help you to get to kn...
Dark Web Presentation - 1.pdf about internet which will help you to get to kn...
ragnaralpha7199
3 years of Quarkus in production, what have we learned - Devoxx Polen
3 years of Quarkus in production, what have we learned - Devoxx Polen
Jago de Vreede
cybercrime investigation and digital forensics
cybercrime investigation and digital forensics
goverdhankumar137300
Timeline Infographics Para utiliza巽達o di叩ria
Timeline Infographics Para utiliza巽達o di叩ria
meslellis
CBUSDAW - Ash Lewis - Reducing LLM Hallucinations
CBUSDAW - Ash Lewis - Reducing LLM Hallucinations
Jason Packer
Ad

Rest API

  • 1. Best Practices for Designing a Pragmatic RESTful API
  • 2. Key requirements for the API It should use web standards where they make sense It should be simple, intuitive and consistent It should be efficient, while maintaining balance with the other requirements
  • 3. The key principles of REST involve separating your API into logical resources. These resources are manipulated using HTTP requests where the method (GET, POST, PUT, PATCH, DELETE) has specific meaning.
  • 4. RESTful principles provide strategies to handle CRUD actions using HTTP methods mapped as follows: GET /tickets - Retrieves a list of tickets GET /tickets/12 - Retrieves a specific ticket POST /tickets - Creates a new ticket PUT /tickets/12 - Updates ticket #12 PATCH /tickets/12 - Partially updates ticket #12 DELETE /tickets/12 - Deletes ticket #12
  • 5. There are no method naming conventions to follow and the URL structure is clean & clear.
  • 6. But how do you deal with relations?
  • 7. GET /tickets/12/messages - Retrieves list of messages for ticket #12 GET /tickets/12/messages/5 - Retrieves message #5 for ticket #12 POST /tickets/12/messages - Creates a new message in ticket #12 PUT /tickets/12/messages/5 - Updates message #5 for ticket #12 PATCH /tickets/12/messages/5 - Partially updates message #5 for ticket #12 DELETE /tickets/12/messages/5 - Deletes message #5 for ticket #12
  • 8. What about actions that don't fit into the world of CRUD operations?
  • 9. An activate action could be mapped to a boolean activated field and updated via a PATCH to the resource PUT /gists/:id/star and DELETE /gists/:id/star Just do what's right from the perspective of the API consumer and make sure it's documented clearly
  • 10. SSL Documentation Versioning
  • 11. Result filtering, sorting & searching GET /tickets?state=open - query parameter that implements a filter GET /tickets?sort=-priority - Retrieves a list of tickets in descending order of priority GET /tickets?q=return&state=open&sort=- priority,created_at - Retrieve the highest priority open tickets mentioning the word 'return'
  • 12. Updates & creation should return a resource representation
  • 15. An API that accepts JSON encoded POST, PUT & PATCH requests should also require the Content-Type header be set to application/json or throw a 415 Unsupported Media Type HTTP status code. JSON encoded POST, PUT & PATCH bodies
  • 16. Rate limiting X-Rate-Limit-Limit - The number of allowed requests in the current period X-Rate-Limit-Remaining - The number of remaining requests in the current period X-Rate-Limit-Reset - The number of seconds left in the current period
  • 18. HTTP status codes 200 OK - Response to a successful GET, PUT, PATCH or DELETE. Can also be used for a POST that doesn't result in a creation. 201 Created - Response to a POST that results in a creation. Should be combined with a Location header pointing to the location of the new resource 204 No Content - Response to a successful request that won't be returning a body (like a DELETE request)
  • 19. 400 Bad Request - The request is malformed, such as if the body does not parse 401 Unauthorized - When no or invalid authentication details are provided. Also useful to trigger an auth popup if the API is used from a browser 403 Forbidden - When authentication succeeded but authenticated user doesn't have access to the resource
  • 20. 404 Not Found - When a non-existent resource is requested 405 Method Not Allowed - When an HTTP method is being requested that isn't allowed for the authenticated user 429 Too Many Requests - When a request is rejected due to rate limiting
  • 21. THX