Backend Development APIs and Web Services Syllabus

List the four levels of the Richardson Maturity Model.

Level 0: The Swamp of POX (single URI, single verb, RPC-style). Level 1: Resources (multiple URIs, still one verb). Level 2: HTTP Verbs (proper use of methods and status codes). Level 3: Hypermedia Controls (HATEOAS).

At which Richardson Maturity Level do most 'RESTful' APIs actually operate, and which level is considered fully RESTful?

Most APIs operate at Level 2 (proper resources + HTTP verbs). Fielding considered only Level 3 (HATEOAS/hypermedia controls) to be truly RESTful.

What is OpenAPI, and what was its predecessor called?

OpenAPI is a language-agnostic specification for describing RESTful APIs (endpoints, parameters, schemas, responses) in a machine-readable format (YAML/JSON). Its predecessor (up to version 2.0) was called Swagger.

Name the top-level required fields of an OpenAPI 3.x document.

openapi (version string), info (title/version metadata), and paths (the endpoints). Common optional roots include servers, components, security, and tags.

In OpenAPI, what is the purpose of the 'components' section?

It holds reusable definitions—schemas, parameters, responses, request bodies, security schemes, etc.—that are referenced elsewhere via $ref to avoid duplication.

What is API-First design?

An approach where the API contract (e.g., an OpenAPI spec) is designed and agreed upon before any implementation. The spec becomes the single source of truth, enabling parallel frontend/backend work, mocking, and code generation.

What is the difference between schema testing and contract testing?

Schema testing validates that a payload conforms to a defined structure/type (e.g., JSON Schema). Contract testing verifies that a consumer and provider agree on the interaction (requests/responses), ensuring changes don't break integrations.

In consumer-driven contract testing (e.g., Pact), who defines the contract and how is it verified?

The consumer defines expectations of the provider by writing a contract (pact) from its tests. The provider then runs those contracts against its real implementation to verify it satisfies every consumer's expectations.

What is a Postman Collection?

A Postman Collection is a saved, shareable group of API requests (with folders, variables, scripts, and tests) used to organize, document, and automate API testing and workflows.

In Postman, what are pre-request scripts versus test scripts?

Pre-request scripts run before a request is sent (e.g., to set variables, generate auth tokens). Test scripts run after the response is received to assert on status, body, headers, and set environment variables.

What is GraphQL, and what defines the shape of its API?

GraphQL is a query language and runtime for APIs where clients request exactly the data they need. Its Schema Definition Language (SDL) defines the types, fields, queries, mutations, and subscriptions the API exposes—the schema is a strongly-typed contract.

In GraphQL SDL, what are the three special root operation types?

Query (read operations), Mutation (write/side-effecting operations), and Subscription (real-time streaming of updates, typically over WebSockets).

What is the difference between a scalar type and an object type in GraphQL?

Scalar types are leaf values with no sub-fields (Int, Float, String, Boolean, ID, plus custom scalars). Object types are composite, containing fields that resolve to other objects or scalars.

In GraphQL SDL, what do the symbols ! and [] mean in a field type like [User!]!?

! denotes non-null. [] denotes a list. [User!]! means a non-null list (the list itself can't be null) whose elements are each non-null User objects.

What is a resolver in GraphQL?

A resolver is a function that returns the value for a particular field in the schema. It typically receives arguments (parent/source, args, context, info) and fetches or computes the field's data.

What is the GraphQL N+1 problem?

When resolving a list of N parent items and then a related field on each, the naive implementation issues 1 query for the list plus N separate queries for the children—N+1 total round-trips—causing severe performance degradation.

How does a DataLoader solve the N+1 problem?

A DataLoader batches individual key requests made within a single tick of the event loop into one bulk fetch and caches results per request, turning N+1 queries into 1 (list) + 1 (batched) queries.

What two core capabilities does DataLoader provide?

Batching (collecting many individual load(key) calls into a single batched backend call) and Caching (memoizing results per key within a request to avoid duplicate fetches).

Give two advantages of GraphQL over REST.

1) Clients fetch exactly the fields they need in a single request, avoiding over-fetching and under-fetching. 2) A strongly-typed schema with introspection enables tooling, validation, and combining multiple resources in one round-trip.

Give two advantages of REST over GraphQL.

1) Native HTTP caching (via GET + cache headers/CDNs) is straightforward, whereas GraphQL POST queries are harder to cache. 2) Simpler operational model—no risk of expensive arbitrary nested queries, easier monitoring, and lower learning curve.

How does error handling differ between REST and GraphQL by default?

REST signals errors via HTTP status codes (4xx/5xx). GraphQL typically returns HTTP 200 even on errors, placing problem details in a top-level 'errors' array alongside partial 'data'.

What is gRPC, and what serialization format and transport does it use?

gRPC is a high-performance RPC framework from Google. It uses Protocol Buffers (protobuf) as its Interface Definition Language and binary serialization, and runs over HTTP/2 for multiplexing and streaming.

What are Protocol Buffers?

Protocol Buffers (protobuf) are a language-neutral, platform-neutral binary serialization format. Messages are defined in .proto files with typed fields and unique field numbers (tags), then compiled into code for many languages.

Why are field numbers (tags) in a .proto message important?

Field numbers identify fields in the binary wire format instead of names, enabling compact encoding and backward/forward compatibility. Existing field numbers must never be reused or changed to preserve compatibility.

What four kinds of RPC methods does gRPC support?

1) Unary (single request, single response), 2) Server streaming, 3) Client streaming, and 4) Bidirectional streaming.

Give two reasons gRPC often outperforms JSON/REST over HTTP/1.1.

1) Protobuf binary encoding is smaller and faster to (de)serialize than text JSON. 2) HTTP/2 provides multiplexed streams, header compression, and persistent connections, reducing latency and overhead.

What is JSON-RPC and how does it differ from REST?

JSON-RPC is a stateless, transport-agnostic remote procedure call protocol that encodes method calls as JSON objects (method, params, id). Unlike REST, it is action/verb-oriented rather than resource-oriented and typically uses a single endpoint with POST.

What fields make up a JSON-RPC 2.0 request object?

jsonrpc (must be "2.0"), method (the procedure name), params (arguments, by-position array or by-name object; optional), and id (a client-set identifier; omitted for notifications).

What is a JSON-RPC notification?

A JSON-RPC request that omits the 'id' member, signaling the client expects no response. The server processes it but must not reply, making it fire-and-forget.

What are WebSockets and how do they differ from HTTP request/response?

WebSockets provide a persistent, full-duplex, bidirectional communication channel over a single TCP connection. Unlike HTTP's request/response model, either party can send messages at any time without polling, enabling real-time push.

How is a WebSocket connection established?

Via an HTTP Upgrade handshake: the client sends a GET with headers Upgrade: websocket, Connection: Upgrade, and Sec-WebSocket-Key. The server replies with 101 Switching Protocols and a computed Sec-WebSocket-Accept, after which the connection switches to the ws:// (or wss://) protocol.