Reference · 42 terms

Glossary

Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.

API basics

API contractAPI contract: Everything a caller can rely on: URLs, methods, request and response shapes, status codes and error format.Lesson 0 →
resourceResource: A thing the API is about, such as a user or an order, which has its own URL.Lesson 0 →
RESTRepresentational State Transfer: A style of web API built on resources with URLs, standard HTTP methods and status codes, and a stateless server.Lesson 0 →
statelessStateless: Each request carries everything the server needs, so the server keeps no memory of earlier requests.Lesson 0 →

ETagEntity tag: A short label for one version of a resource, which changes when the resource changes.Lesson 1 →
exponential backoffExponential backoff: Waiting longer after each failed retry (1 s, 2 s, 4 s) with a little random time added so clients do not retry together.Lesson 1 →
idempotencyIdempotency: Doing the same request once or many times leaves the server in the same state, so a retry is safe.Lesson 1 →
optimistic concurrencyOptimistic concurrency: Let people edit freely, and reject a save with 412 if the thing changed since they read it.Lesson 1 →
safe methodSafe HTTP method: A method meant only to read, which must not change server state in a way the client asked for, such as GET.Lesson 1 →

DTOData Transfer Object: A plain object that describes the public shape of a request or response, kept apart from the database row.Lesson 2 →
mass assignmentMass assignment: A bug where the server copies every field a client sent into the database, letting the client set fields like role.Lesson 2 →
minor unitsMinor units: The smallest part of a currency as a whole number, such as cents, so 19.99 EUR is sent as 1999.Lesson 2 →
problem detailsProblem Details for HTTP APIs: The standard JSON error format with type, title, status, detail and instance, sent as application/problem+json.Lesson 2 →
RFC 3339RFC 3339 date and time: A standard text format for dates and times, such as 2026-03-08T14:30:00Z, where the Z means UTC.Lesson 2 →

cursor paginationCursor (keyset) pagination: Paging by asking for the rows after the last one you saw, which stays fast and stable on any page.Lesson 3 →
offset paginationOffset pagination: Paging by skipping N rows then taking M, which gets slower on deep pages and can repeat or miss rows when data changes.Lesson 3 →
opaque cursorOpaque cursor: A position string the client sends back unchanged and must not read or build itself.Lesson 3 →
tie-breakerSort tie-breaker: A unique column, usually id, added last in the sort so rows with equal values keep a fixed order.Lesson 3 →

breaking changeBreaking change: A change that makes a correct, existing client fail or behave wrongly, such as renaming or removing a field.Lesson 4 →
deprecationDeprecation and sunset: Marking a feature as still working but going away, with a sunset date after which it stops working.Lesson 4 →
expand and contractExpand and contract: Change an API safely in three steps: add the new thing, move clients over, then remove the old thing.Lesson 4 →
tolerant readerTolerant reader: A client that reads only the fields it needs, ignores unknown ones, and has a fallback for unknown enum values.Lesson 4 →

exponential backoffExponential backoff with jitter: Waiting longer after each failed try, with some randomness, so many clients do not retry at the same moment.Lesson 5 →
HMACHash-based Message Authentication Code: A way to sign a message with a shared secret so the receiver can check it was not changed and came from the sender.Lesson 5 →
idempotency keyIdempotency key: A unique value the client sends with a POST so the server can recognise a retry and not do the work twice.Lesson 5 →
rate limitRate limit: A cap on how many requests a client may send in a time window, answered with 429 when exceeded.Lesson 5 →
webhookWebhook: A request your server sends to a customer's URL when an event happens, so they do not have to keep asking.Lesson 5 →

API keyAPI key: A long random string that identifies the application calling an API; store only its hash.Lesson 6 →
authenticationAuthentication: Proving who the caller is, for example with a password, an API key or a token.Lesson 6 →
authorizationAuthorization: Deciding what an already identified caller is allowed to do.Lesson 6 →
BOLABroken Object Level Authorization: An API returns an object by id without checking that the caller may access it.Lesson 6 →
JWTJSON Web Token: A signed token with a header, a payload of claims and a signature; the payload is readable by anyone.Lesson 6 →
mass assignmentMass assignment: Copying every field from a request into a record, so a caller can set fields like role that they should not.Lesson 6 →
OAuth 2.0OAuth 2.0: A standard that lets a user give an app limited access to their data in another service without sharing a password.Lesson 6 →
PKCEProof Key for Code Exchange: An addition to the OAuth code flow where the client proves it started the login, so a stolen code is useless.Lesson 6 →
scopeOAuth scope: A named permission on a token, such as orders:read, that limits what the app may do.Lesson 6 →

contract testContract test: A test that calls the real API and checks the response against the written contract to catch drift.Lesson 7 →
OpenAPIOpenAPI Specification: A standard file format that describes an HTTP API so tools can make docs, checks, mocks and client code.Lesson 7 →

GraphQLGraphQL: A typed query language for APIs where the client asks for exactly the fields it needs, usually through one URL.Lesson 8 →
gRPCgRPC: A framework for calling functions on another service over HTTP/2, usually with Protocol Buffers messages.Lesson 8 →
N+1 problemN+1 problem: One query for a list followed by one more query per item, which can be fixed by batching the lookups.Lesson 8 →
Protocol BuffersProtocol Buffers: A compact binary message format defined in .proto files, where numbered fields are the real contract.Lesson 8 →