Chapter 6: HTTP, REST APIs, and API Gateway Patterns
HTTP Methods (Verbs)
| Method | Purpose | Idempotent? | Body? |
|---|---|---|---|
| GET | Read a resource | Yes | No |
| POST | Create a resource | No | Yes |
| PUT | Replace a resource entirely | Yes | Yes |
| PATCH | Partial update | No | Yes |
| DELETE | Remove a resource | Yes | No |
REST API Design
// Resources as nouns, HTTP verbs as actions:
GET /users → list users
GET /users/123 → get user 123
POST /users → create user
PUT /users/123 → replace user 123
PATCH /users/123 → update fields of user 123
DELETE /users/123 → delete user 123
GET /users/123/orders → list orders for user 123
API Gateway Pattern
Clients ──► API Gateway ──► User Service
──► Order Service
──► Payment Service
Gateway handles:
• Authentication/authorization
• Rate limiting
• Request routing
• Protocol translation (REST→gRPC)
• Response aggregation
• SSL termination
• Logging/monitoring
Examples: Kong, Envoy, AWS API Gateway, nginx
Idempotency
An operation is idempotent if calling it multiple times produces the same result as calling it once. Critical for retries in distributed systems.
// Idempotent: safe to retry
GET /users/123 → always returns same user
PUT /users/123 {name:"Bob"} → always sets name to Bob
DELETE /users/123 → user is deleted (already deleted = still deleted)
// NOT idempotent: dangerous to retry
POST /orders {item:"book"} → creates a NEW order each time!
// Fix: use idempotency key
POST /orders {item:"book", idempotency_key:"abc123"}
// Server checks: already processed abc123? Return cached response.
HTTP Status Codes
| Range | Meaning | Common Codes |
|---|---|---|
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirect | 301 Permanent, 302 Temporary, 304 Not Modified |
| 4xx | Client error | 400 Bad Request, 401 Unauthorized, 404 Not Found, 429 Too Many Requests |
| 5xx | Server error | 500 Internal Error, 502 Bad Gateway, 503 Service Unavailable |
Key Takeaways
- REST: resources as URLs, HTTP verbs as actions
- API Gateway: single entry point handling cross-cutting concerns
- Idempotency is critical for safe retries in distributed systems
- Use idempotency keys for non-idempotent operations (POST)
- Status codes communicate success/failure semantics