Back-end Web Developement APIs Syllabus

APIs syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for APIs in Back-end Web Developement, not a summary of it.

1. 1

   REST

   3 topics

   • Principles
   • Best Practices
   • Authentication & Authorization
2. 2

   GraphQL

   3 topics

   • Schema Definition
   • Resolvers
   • Queries and Mutations
3. 3

   WebSockets

   2 topics

   • Real-time Communication
   • Socket.IO

APIs flashcards for Back-end Web Developement

22 of 51 cards from the APIs deck — real questions with worked answers.

1. What does API stand for, and what is its core purpose?

   Application Programming Interface. It is a defined contract that lets two software systems communicate, exposing a set of operations a client can invoke while hiding the provider's internal implementation.

2. State the REST architectural principle of statelessness.

   Each request from client to server must contain all information needed to understand and process it; the server stores no client session state between requests, so any server can handle any request.

3. List the core constraints of the REST architectural style.

   Client-server separation, statelessness, cacheability, uniform interface, layered system, and (optionally) code-on-demand.

4. What is the 'uniform interface' constraint in REST, and its four sub-principles?

   A consistent way of interacting with resources. Its sub-principles are: resource identification via URIs, manipulation of resources through representations, self-descriptive messages, and HATEOAS (hypermedia as the engine of application state).

5. In REST, what is a 'resource' versus a 'representation'?

   A resource is any named information/entity the API exposes (e.g., a user). A representation is a concrete serialized form of that resource's state at a point in time (e.g., JSON or XML), transferred between client and server.

6. Match the primary HTTP methods to their CRUD operations.

   POST = Create, GET = Read, PUT/PATCH = Update, DELETE = Delete.

7. What is the difference between PUT and PATCH?

   PUT replaces the entire resource with the provided representation (idempotent full update). PATCH applies a partial modification, updating only the specified fields.

8. Define idempotency for an HTTP method and list which standard methods are idempotent.

   An operation is idempotent if making the same request multiple times yields the same server state as making it once. GET, PUT, DELETE, HEAD, and OPTIONS are idempotent; POST and PATCH generally are not.

9. Which HTTP methods are considered 'safe', and what does safe mean?

   GET, HEAD, and OPTIONS are safe. Safe means the method is read-only and does not alter server state.

10. What do the HTTP status code classes 2xx, 3xx, 4xx, and 5xx signify?

    2xx = Success, 3xx = Redirection, 4xx = Client error, 5xx = Server error.

11. Give the meaning of status codes 200, 201, 204, 400, 401, 403, 404, and 500.

    200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized (not authenticated), 403 Forbidden (authenticated but not permitted), 404 Not Found, 500 Internal Server Error.

12. What is the difference between HTTP 401 and 403?

    401 Unauthorized means the request lacks valid authentication credentials (who are you?). 403 Forbidden means the client is authenticated but lacks permission for the resource (you can't do this).

13. What is a REST best practice for naming resource endpoints?

    Use plural nouns (not verbs) for collections, e.g. GET /users and GET /users/{id}; express hierarchy through nested paths like /users/{id}/orders, and let the HTTP method convey the action.

14. Why and how should a REST API implement versioning?

    To evolve the API without breaking existing clients. Common strategies: URI versioning (/v1/users), custom header, or media-type/content negotiation (Accept: application/vnd.api.v1+json).

15. What is pagination in an API, and name two common strategies.

    Splitting large result sets into smaller pages to limit payload size. Strategies: offset/limit (or page/size) pagination, and cursor-based (keyset) pagination using an opaque pointer to the last item.

16. What is rate limiting and why is it a best practice?

    Restricting how many requests a client may make in a time window to protect the server from abuse/overload and ensure fair usage. Often signaled via headers like X-RateLimit-Remaining and status 429 Too Many Requests.

17. What is CORS and what problem does it solve?

    Cross-Origin Resource Sharing: an HTTP-header-based mechanism letting a server declare which origins (other than its own) may access its resources, relaxing the browser's same-origin policy in a controlled way.

18. Distinguish authentication from authorization.

    Authentication verifies identity (who you are). Authorization determines what an authenticated identity is permitted to do (which resources/actions are allowed).

19. What are the three parts of a JWT (JSON Web Token), separated by dots?

    Header, Payload, and Signature — each Base64URL-encoded and joined as header.payload.signature.

20. How does a JWT's signature guarantee integrity?

    The signature is computed over the encoded header and payload with a secret or private key (e.g., HMAC-SHA256 or RSA). Any tampering with header/payload invalidates the signature when the server re-verifies it, so altered tokens are rejected.

21. Contrast stateful (session-based) authentication with stateless (token-based) authentication.

    Session-based: server stores session state and gives the client a session ID (usually in a cookie); server must look it up each request. Token-based (e.g., JWT): the token itself carries the claims and is verified by signature, so the server keeps no per-session state.

22. In the OAuth 2.0 framework, name the four main roles.

    Resource Owner (the user), Client (the app requesting access), Authorization Server (issues tokens), and Resource Server (hosts the protected resources).

See more APIs flashcards →

Planning APIs for Back-end Web Developement

APIs (Back-end Web Developement) FAQ