REST APIs: Design, Build, Document and Test

What's inside

1. Level 1: Anatomy of an HTTP Request and ResponseFree
   Learn what goes over the wire when a client talks to an API: the request line, headers and body going out, and the status line, headers and body coming back, as described in RFC 9110 (HTTP Semantics).
2. Level 2: HTTP Methods, Safety and IdempotencyFree
   Understand what GET, POST, PUT, PATCH and DELETE are meant to do, and which methods are safe or idempotent so clients and proxies know when a request can be retried.
3. Level 3: Status Codes That Tell the Truth
   Learn the five status code classes and the codes an API uses most, so every response tells the client clearly what happened.
4. Level 4: Resources, URLs and Naming
   Design a clean URL structure by modelling your domain as resources and collections, with consistent naming, nesting and query parameters.
5. Level 5: JSON, Content Types and Headers
   Work with JSON request and response bodies and the headers that describe them, including Content-Type, Accept, Location and custom headers.
6. Level 6: Calling APIs from Python and JavaScript
   Move from curl to code by calling a real public API with Python requests or httpx and with JavaScript fetch, handling status codes, timeouts and JSON parsing properly.
7. Level 7: Build Your First API with FastAPI or Express
   Build a small working CRUD API for one resource in Python with FastAPI or in Node.js with Express 5, using an in-memory store, and check it with curl.
8. Level 8: Validating Input at the Edge
   Reject bad input before it reaches your logic by declaring request schemas with Pydantic models in FastAPI or a schema library such as Zod in Express.
9. Level 9: Consistent Errors with Problem Details
   Give every error the same machine-readable shape using Problem Details for HTTP APIs (RFC 9457, which replaced RFC 7807) and the application/problem+json media type.
10. Level 10: Pagination, Filtering and Sorting
    Make large collections usable by adding offset and cursor-based pagination, filtering and sorting through query parameters.
11. Level 11: Protecting Endpoints with API Keys
    Add API key authentication to your API: generate keys safely, send them in a header, store only their hashes and return the right 401 and 403 responses.
12. Level 12: OAuth 2.0 and JWTs in Plain Terms
    Understand how OAuth 2.0 lets apps act for users without seeing their passwords, and how to validate a JWT bearer token in your API.
13. Level 13: CORS: Letting Browsers In Safely
    Learn why browsers block cross-origin calls, how preflight requests work, and how to configure CORS on your API without opening it to everyone.
14. Level 14: Versioning Without Breaking Clients
    Evolve an API safely by telling breaking changes from additive ones, choosing a versioning strategy and retiring old versions gracefully.
15. Level 15: OpenAPI Specs and Generated Docs
    Describe your API in an OpenAPI document (3.1 is widely supported; 3.2.0 is the current version, released September 2025) and use it to generate interactive documentation and client code.
16. Level 16: Testing APIs by Hand and Automatically
    Test your API by hand with an HTTP client, then write automated tests with pytest and httpx or with Jest or Vitest plus Supertest, including tests for errors and auth.
17. Level 17: Rate Limits, Retries and Backoff
    Protect your API with rate limiting and write clients that respond well to 429 and 503 responses by using Retry-After, exponential backoff with jitter, and idempotency keys.
18. Level 18: Sending and Verifying Webhooks
    Push events to other systems with webhooks: design the event payload, sign it with HMAC, verify it on the receiving end, and handle retries and duplicates.
19. Level 19: Caching with ETags and Conditional Requests
    Cut bandwidth and prevent lost updates by using ETags, Cache-Control and conditional requests with If-None-Match and If-Match.
20. Level 20: When GraphQL or gRPC Fit Better
    Teaches the two main alternatives to REST side by side: what GraphQL and gRPC are, what each costs, and how to decide which an API should use.
21. Level 21: Final Challenge: Ship a Production-Ready API Exam
    Bring the whole course together by designing, building, documenting, testing and security-reviewing a complete API against the OWASP API Security Top 10 (2023 edition), then judging where GraphQL or gRPC would fit better than REST.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →