APIs — 80 free lessons

how programs talk to each other · rest · graphql · webhooks

Start lesson 1 →

API Tutorial

1. What is an API · The Contract2. Why APIS · Machines Talking to Machines3. HTTP Basics · Request · Response4. HTTP Methods · GET · POST · PUT · PATCH · DELETE5. HTTP Status Codes · 2xx · 3xx · 4xx · 5xx6. Request Headers · Accept · Auth · Content-Type7. Response Headers · CORS · Cache · Set-Cookie8. URLS · Scheme · Host · Path · Query · Fragment9. Query Strings · Key=value · Encoding10. JSON · The Lingua Franca11. XML · The Legacy Lingua Franca12. Form Data · Multipart · Urlencoded

API Styles

13. REST · The Architectural Style14. REST Principles · Stateless · Uniform · Cacheable15. Resources · Nouns Over Verbs16. CRUD · The Four Basic Ops17. Pagination · Offset · Cursor · Keyset18. Filtering · Sorting · Query Params19. Versioning · /V1/ · Headers · Subdomains20. Graphql · Query Language for APIS21. Graphql · Queries · Mutations · Subscriptions22. Graphql · Schema · Resolvers · Types23. Graphql vs REST · When Each Wins24. Soap · The Enterprise Legacy25. Grpc · Binary · Streaming · Protobuf26. Webhooks · Pushing Events to Subscribers27. Websockets · Bidirectional Realtime28. Server-Sent Events · One-Way Realtime29. Polling vs Long-Polling vs Push

API Auth

30. Authentication · Who are you31. Authorization · What Can you Do32. API Keys · The Simplest Secret33. Basic Auth · The Legacy Header34. Bearer Tokens · The Standard35. Oauth 2.0 · Delegated Access36. Oauth · Authorization Code Flow37. Oauth · Client Credentials · Device Code38. Openid Connect · Oauth + Identity39. JWT · The Self-Contained Token40. JWT · Header · Payload · Signature41. Refresh Tokens · Keeping Sessions Alive42. Session Cookies · Server-Managed Sessions43. Csrf · Same-Site · Double Submit

API CORS

44. CORS · Cross-Origin Requests45. CORS · Preflight · The OPTIONS Round-Trip

API Reliability

46. Rate Limiting · Protecting the API47. Rate Limiting · Token Bucket · Sliding Window48. Retry-After · Backoff · Idempotency49. Idempotency Keys · Safe Retries50. Caching · Etag · Last-Modified51. Caching · Vary · Cache-Control · Expires52. CDN Caching · Edge Caches

API Errors & Content

53. Error Responses · Problem+json · Message + Code54. Validation · Request Shape · 400 vs 42255. Content Negotiation · Accept · Vary56. Compression · Gzip · Brotli · Zstd

API Transport

57. HTTPS · Why TLS is Non-Negotiable58. TLS · Certificates · Sni

API Infrastructure

59. API Gateways · The Front Door60. Service Mesh · Sidecar Proxies61. Discovery · Service Registry · DNS62. Health Checks · Liveness · Readiness63. Observability · Logs · Metrics · Traces64. Tracing · Opentelemetry · Spans65. Metrics · Histograms · Counters · Gauges66. Logging · Structured JSON · Levels

API Testing & Schema

67. Testing APIS · Contract Testing · Pact68. Testing APIS · Postman · Insomnia · Curl69. Mock Servers · Stubs · Fakes70. Openapi · The Schema-First Approach71. Asyncapi · Spec for Event-Driven72. Sdks · Generated vs Hand-Written

API Design

73. API Design · Resources First · Then Verbs74. API Design · Pagination · Filtering · Expansion75. API Design · The Principle of Least Surprise76. API Design · Evolving Without Breaking77. Deprecation · Sunset · Warnings · Grace78. API Governance · Style Guides · Review79. Monetization · Plans · Quotas · Usage-Based

API References

80. References · HTTP Spec · Oauth Rfcs · Openapi Spec