Productivity · Advanced
APIs: How They Actually Work
Endpoints, entities, HTTP, REST, GraphQL, gRPC, OpenAPI and Swagger, OAuth 2.0, OIDC, JWTs, security, reliability and the words engineers use in design reviews.
What you will learn
The 15 topics inside APIs: How They Actually Work
Each topic has its own goal, its own questions and its own mastery score, so you always know which part is still weak.
API keys, sessions, scopes and authorization
Separate authentication from authorization and compare API keys, session cookies, bearer tokens, mTLS, scopes, roles and object-level checks.
API security vocabulary
Name the OWASP API Security Top 10 risks, including BOLA, broken function-level authorization, mass assignment and SSRF, and explain CORS and rate limiting.
Architecture and operating APIs
Name API gateways, backends for frontends, service meshes, CQRS and sagas, and operating terms such as SLI, SLO, SLA, error budgets and distributed tracing.
Design: pagination, errors and filtering
Name and compare pagination styles, error formats such as RFC 9457 problem details, filtering, sorting and field selection.
Endpoints, resources and entities
Explain resources, endpoints, routes, path and query parameters, request and response bodies, entities, DTOs and nested resources, and describe an endpoint out loud.
GraphQL, gRPC, webhooks and streaming
Explain how GraphQL, gRPC with protobuf, webhooks, WebSockets and server-sent events work and when engineers choose each.
HTTP precisely
Name HTTP methods, safe and idempotent semantics, status codes and headers precisely, including 401 vs 403, 409 vs 422 and 502 vs 504.
OAuth 2.0 flows end to end
Walk through the authorization code flow with PKCE, client credentials, device authorization and refresh, naming each role and each request.
OpenAPI and Swagger
Explain the difference between OpenAPI and Swagger, the parts of a spec file (paths, operations, parameters, components, schemas, security schemes), Swagger UI, code generation and mock servers.
Performance and caching
Use latency percentiles, throughput, ETags, conditional requests and Cache-Control correctly.
Reliability patterns
Explain idempotency keys, retries with exponential backoff and jitter, timeouts, circuit breakers and delivery guarantees.
REST vocabulary
Use REST terms correctly: representations, statelessness, uniform interface, HATEOAS and the Richardson maturity model.
Speaking the language in reviews and integrations
Use precise API vocabulary to frame a design review, push back on a breaking change, scope a vendor integration and describe an incident.
Tokens, JWTs and OIDC
Explain access, refresh and ID tokens, bearer tokens, JWT header, payload and signature, standard claims, validation, expiry and revocation, and what OpenID Connect adds.
Versioning and breaking changes
Classify changes as breaking or non-breaking and explain versioning strategies, deprecation and the Sunset header.
Example questions
Real questions from this course
These are taken straight from the course. Pick an answer, then open the explanation to see why it is right.
Sample 01
An edge reverse proxy receives an incoming client request and attempts to forward it to an internal backend microservice. Upon receiving the connection attempt, the backend microservice immediately responds with a corrupted, malformed HTTP header block that the proxy cannot parse. The reverse proxy terminates the upstream connection immediately without waiting for any timeout thresholds to expire. Which HTTP status code should the reverse proxy return to the client to indicate this specific failure?
Show the answer and why
Answer: The proxy should return 502 Bad Gateway because it received an invalid or unparseable response from the upstream server.
The status code 502 Bad Gateway indicates that a server acting as a gateway or proxy received an invalid response from an inbound server. Because the backend responded immediately with invalid headers rather than timing out, 504 Gateway Timeout does not apply.
The reverse proxy should return 502 Bad Gateway to indicate that it received an invalid response from an upstream server. While both 502 and 504 are gateway error status codes, 502 specifically denotes a bad or unparseable upstream response. In contrast, 504 Gateway Timeout is reserved for when the upstream server fails to respond within a specified time limit.
Sample 02
How does OpenAPI 3.1 handle reusable data models across different operations?
Show the answer and why
Answer: Reusable models rely on JSON Schema definitions in the components section that can be referenced throughout the document.
OpenAPI 3.1 aligns component schema definitions with JSON Schema for reusability across endpoints, while keeping the components section optional overall, defending against the misconception that components are required in every spec.
Reusable data models are defined under components schemas using JSON Schema alignment. These schemas can then be referenced across multiple operation request bodies and responses using reference keys.
Sample 03
What media type header must an API server return when providing an RFC 9457 problem detail JSON payload?
Show the answer and why
Answer: The required response Content-Type header is application/problem+json.
RFC 9457 defines specific media types for problem details so that HTTP clients can automatically recognize and handle structured error responses. For JSON payloads, application/problem+json is required. This defends against returning generic application/json or 200 OK bodies for errors.
The server must set the Content-Type header to application/problem+json when delivering an RFC 9457 JSON problem detail object. This explicit media type allows clients to parse the error structure deterministically.
APIs: How They Actually Work is free with an account, along with every other course in the library.
Start free