#API
17 articles
Designing Secure API Tokens with NIST CSF 2.0: Working Backward from Protect and Detect
Design an API token feature such as Personal Access Tokens (PATs) by working backward from the six NIST CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover). Covers the DB schema, token format, scope checks, anomaly detection, secret scanning, and revocation with code examples.
Secure API: Principles for Design, Construction, and Implementation
A review of Secure API. A book that treats API security as consistent principles spanning design, construction, and implementation. From authn/authz, TLS, and secret management to dependency vulnerabilities and CI/CD, it organizes the whole API lifecycle from the threat-based view of why it is needed.
Hands-On API Learning
A review of Hands-On API Learning. A practical book you learn by building, spanning API design, implementation, testing, and operations. It covers essentials for long-term operation such as design principles, documentation, versioning, and security, and works as a checklist for revisiting your own API design.
Comparing API Styles: REST, GraphQL, gRPC, Webhooks, WebSocket, and Messaging
Six common API styles, REST, GraphQL, gRPC, Webhooks, WebSocket, and Messaging, compared side by side. This article organizes them by communication model, lays out each style's overview, design considerations, and pros and cons, and gives guidance for choosing. A map for picking a style in API design.
When to Use GraphQL: Adoption Criteria and Trade-offs
When should you adopt GraphQL? This guide covers its core ideas (a typed schema, a single endpoint, fetching exactly what you need), where it fits and where it does not, the trade-offs, operational concerns such as N+1, and how it compares with REST and gRPC.
When to Use gRPC: Adoption Criteria and Trade-offs
When should you adopt gRPC? This guide covers its core ideas (RPC, HTTP/2, Protocol Buffers), where it fits and where it does not, the trade-offs, operational concerns, and how it compares with REST and GraphQL.
Comparing API Versioning Strategies: Path, Query, Header, and Payload
A concise comparison of four API versioning strategies — path, query parameter, header, and message payload — covering their pros, cons, and best fit.
Mastering API Architecture: Practical Techniques for Evolving Architecture from Monolithic to Microservices
A review of Mastering API Architecture. Using C4 diagrams and ADRs, it explains API architecture patterns, testing, operations, and security. More of an overview than a deep dive, it suits grasping the big picture of evolving architecture from monolithic to microservices.
API Design Patterns
A review of API Design Patterns. Starting from API design principles, it introduces a wealth of patterns such as resource-oriented (combining standard methods) and RPC-oriented (invoking procedures), teaching perspectives for good API design like being actionable, in a systematic way.
Books to Learn About API Design
Discover recommended books on API design: fundamentals, design phases, testing strategies, and practical design patterns.
Web API Design
A review of Web API Design. A book that has you think about API design not just from the interface but from the entry point before it. It offers perspectives for designing good APIs: focusing on what users can do rather than the mechanism, and frameworks for surfacing an API's goals.
Web API Testing Techniques
A review of Web API Testing Techniques. A book that explains API testing through frameworks like asking questions with the 5W1H and the ten Ps model for grasping testability. From building test strategy and plans to security perspectives via STRIDE and threat trees, it offers views useful in practice.
What is GraphQL
Understand GraphQL as a query language for APIs with flexible data selection, single endpoint, and type system advantages.
Creating a Rest API with Laravel
Create Laravel REST APIs using ResourceControllers with authentication middleware and JSON responses.
Notify Bitcoin Asset Status to Slack Using bitFlyer's Private API Part 2
Implement Bitcoin monitoring using async/await, bitFlyer private API authentication, and Slack integration.
Notify Bitcoin Asset Status on Slack Using bitFlyer's Private API
Learn bitFlyer API integration with Node.js, HMAC-SHA256 signing, and Slack webhook message formatting.
Web API: The Good Parts
A review of Web API: The Good Parts. A standard book to read first when learning how to design web APIs. Covering the basics of API design, such as endpoint design and how to return responses, it is one you will want to reread whenever you are unsure about a design.