12 Rules to build REST API

 



1. Use consistent resource naming

Plural nouns, kebab-case, no verbs.
Your URLs are nouns. HTTP methods are the verbs.
`/api/users`, `/api/order-items`, never `/api/getUsers`.


2. Version from day one

Put `/v1/` in your base path before you ship.
Retrofitting versioning onto a live API is painful. Starting with it is free.


3. Use proper HTTP status codes

Not everything is 200. Not every error is 500.


4. Implement pagination from the start

Every list endpoint should support `?page=1&limit=20` or cursor-based pagination from day one.
Add filtering and sorting through query params (`?status=active&sort=name`).
Keeps your API flexible without new endpoints.


5. Use DTOs. Don't leak your DB schema

Your database model is not your API response.
Shape what goes out. Strip internal IDs, timestamps you don't want exposed, and sensitive fields.


6. Add rate limiting

One abusive client shouldn't take down your API.
`express-rate-limit` takes five lines.
For production, back it with Redis so it works across instances.


7. Design for idempotency

Network failures happen. Idempotency means retries are safe.


8. Standardize error responses

Every error from your API should have the same shape:
Use a global error handler to enforce this. Clients should never have to guess what an error looks like.


9. Use proper authentication patterns

Always send tokens in the `Authorization: Bearer <token>` header, never in query params.
Separate authentication (who are you?) from authorization (what can you do?).
Different middleware for each.


10. Document your API

An undocumented API is a private API.
Use OpenAPI/Swagger, which lets you auto-generate client SDKs, validate requests, and run contract tests.


11. Add health check endpoints

Every API needs `/health`.
It's how load balancers and Kubernetes know your service is alive.


12. Add observability from day one

Structured JSON logs (not console.log) with request ID, user ID, and duration on every request. Correlation IDs that flow across service boundaries. Metrics on response times, error rates, and throughput per endpoint.

Comments

Post a Comment

Popular posts from this blog

𝗙𝗹𝘂𝗲𝗻𝘁𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻 𝗶𝗻 𝗔𝗦𝗣.𝗡𝗘𝗧 𝗖𝗼𝗿𝗲 - 𝗖𝗹𝗲𝗮𝗻, 𝗙𝗹𝗲𝘅𝗶𝗯𝗹𝗲 𝗠𝗼𝗱𝗲𝗹 𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝗠𝗼𝗱𝗲𝗿𝗻 .𝗡𝗘𝗧 𝗔𝗽𝗽𝘀

Image
FluentValidation is a popular .NET library that makes it easy to check if your objects have valid data. It’s like a set of rules you create to make sure your objects follow the correct format. The best part? It uses a clean and readable style that even beginners can understand. In this guide, we’ll walk you through how to use  FluentValidation  step-by-step, using a practical  User Registration  example. By the end, you’ll see how it simplifies input validation, keeps your code clean, and improves maintainability in your ASP.NET Core applications. 📘 What is FluentValidation? Think of FluentValidation as a rulebook for your objects. Imagine you're building a  library system . You need to ensure: The library has a name Each book has a valid ID, title, and author The library has a valid address, phone number, and at least five books Instead of writing lots of messy  if  conditions,  FluentValidation  allows you to define all these rules in one ...
Read more

Performance Optimization in Sitecore

  Performance Optimization in Sitecore Caching Strategies Implementing caching properly in Sitecore significantly improves performance. The following caching techniques should be used:   HTML Caching Ø   Store rendered HTML output to reduce processing time. Ø   Enable caching on Sitecore renderings (Caching tab in Sitecore Experience Editor). Ø   Configure vary by parameters to cache different versions of content. Data Caching Ø   Use Sitecore’s Data Cache to store frequently accessed database queries. Ø   Implement custom memory caches using .NET MemoryCache for high-frequency data. Ø   Leverage pre-fetch caching to load important content in advance. Output Caching Ø   Store entire page outputs in the cache for quick retrieval. Ø   Configure Sitecore Output Cache settings at the item level. Ø   Set cache expiration rules to balance freshness and performance.   Load Balancing & Database Optimiz...
Read more

Azure Event Grid Sample code

  Event Grid Azure Event Grid is a fully managed event routing service that enables event-driven architectures by: •                Delivering events from sources to subscribers in near real-time. •                Supporting fan-out (sending the same event to multiple subscribers). •                Ensuring high reliability and scalability. How Event Grid Fits in SOA Decoupling Services: SOA often involves tightly coupled services that rely on synchronous communication (e.g., REST or SOAP APIs). Event Grid enables asynchronous communication by routing events between services, reducing coupling and improving scalability. Event-Driven Communication: Instead of services polling for updates or making direct API calls, they can react to events published to Event ...
Read more