REST API

Question 1

What is REST?

Answer 1

REpresentational State Transfer. Is an architectural style for providing standards between computer systems on the web, making it easier for systems to communicate with each other

Question 2

What is API?

Answer 2

Application programming interface. Is a computing interface that defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc.

Question 3

What is HEAD request?

Answer 3

• The HTTP HEAD method is used to request HTTP headers from the server.
• The HTTP HEAD request is identical to the GET request except that the server must not return the message body in the response.
• The HTTP HEAD request may be executed before loading a large resource, to check resource size, validity, accessibility, and recent modification.

Question 4

What is http header?

Answer 4

HTTP headers let the client and the server pass additional information with an HTTP request or response

( Content-Type for example )

Question 5

What is the difference between POST and PUT?

Answer 5

Practically speaking, POST is used to append a resource to an existing collection, while PUT is used to update an existing resource.

PUT puts a file or resource at a specific URI, and exactly at that URI.

POST sends data to a specific URI and expects the resource at that URI to handle the request

Question 6

What are the most important points when you develop API?

Answer 6

• security
• accessibility
• usability
• reliability
• versioning

Question 7

What authentication API methods do you know?

Answer 7

• Username and password as parameters
• HTTP basic authentication
• HTTP cookies
• SAML
• JWT

Question 8

What is HTTP basic authentication?

Answer 8

When we use:
• HTTP methods: GET, POST, PUT, DELETE, PATCH, and
more
• HTTP header: Authorization: Basic bXk6Ym9vaw==
• Content-Type: Any

Question 9

What is ‘Username, password as parameters’ authentication methods?

Answer 9

When payload (message body) includes username and password.

HTTP methods: POST, PUT, PATCH, and more.
Methods like GET or DELETE may include username
and password as URL query parameters (i.e. GET /authenticate?
username=bob&password=secret)

Question 10

What 2 authorization approaches do you know?

Answer 10

• Preemptive Authorizations
• Just-in-Time Authorizations

Question 11

What are the difference between Preemptive Authorizations and Just-in-Time Authorizations?

Answer 11

Preemptive Authorizations:
- User instructs client to make a request to http://user:pass@example.com
- Client makes a request with a header like: Authorization: Basic dXNlcjpwYXNz
- Server authenticates the user and response with 200

Just-in-Time Authorizations:

• User instructs client to make a request to http://user:pass@example.com
• Client makes a request without authentication
• Server responds with 401 and a header like: WWW-Authenticate: Basic realm=”Default Realm”
• Client makes a second request with a header like: Authorization: Basic dXNlcjpwYXNz
• Server authenticates the user and response with 200

Question 12

What OAuth flows ( grand types ) do you know?

Answer 12

• Implicit grand ( one request and you get access token )
• Authorization code grand ( first request gets authorization code the second gets access token)
• Resource Owner Password Credentials (ROPC) Grant ( One request and you send password in this request)
• Refresh Token Grant ( one request to get a new access_token using refresh token)
• Client Credentials Grant ( the same as password but with credentials)

Question 13

What part we need to consider during API implementation?

Answer 13

• Security
• API restriction
• Rate limit
• Request size/type validation
• Response handling
• Errors handling
• Caching
• Documentation

Question 14

What is API gateway?

Answer 14

It’s like api proxy. It’s like additional layer to handle common things for API. API gateway doesn’t keep business logic.

Question 15

What Are API Gateways Used For?

Answer 15

1. Access control (i.e. who can access)
2. Network-level security (i.e. use of TLS)
3. Message security (i.e. message encryption)
4. Message validation and transformation (i.e. from JSON to
   XML)
5. Message routing (i.e. forwarding messages via HTTP)
6. API availability (i.e. accessible during certain hours)
7. Logging
8. Threat protection (i.e. protecting against SQL injection)
9. Support for messaging (i.e. HTTP to MQTT)
10. Support for accessing data sources (i.e. accessing
    databases)

Question 16

Why do we need API gateway?

Answer 16

• Load balancing
• Concern separation
• Mocking API