Chapter 6: HTTP, REST APIs, and API Gateway Patterns

HTTP Methods (Verbs)

MethodPurposeIdempotent?Body?
GETRead a resourceYesNo
POSTCreate a resourceNoYes
PUTReplace a resource entirelyYesYes
PATCHPartial updateNoYes
DELETERemove a resourceYesNo

REST API Design

// Resources as nouns, HTTP verbs as actions:
GET    /users          → list users
GET    /users/123      → get user 123
POST   /users          → create user
PUT    /users/123      → replace user 123
PATCH  /users/123      → update fields of user 123
DELETE /users/123      → delete user 123
GET    /users/123/orders → list orders for user 123

API Gateway Pattern

Clients ──► API Gateway ──► User Service ──► Order Service ──► Payment Service Gateway handles: • Authentication/authorization • Rate limiting • Request routing • Protocol translation (REST→gRPC) • Response aggregation • SSL termination • Logging/monitoring Examples: Kong, Envoy, AWS API Gateway, nginx

Idempotency

An operation is idempotent if calling it multiple times produces the same result as calling it once. Critical for retries in distributed systems.

// Idempotent: safe to retry
GET /users/123           → always returns same user
PUT /users/123 {name:"Bob"} → always sets name to Bob
DELETE /users/123        → user is deleted (already deleted = still deleted)

// NOT idempotent: dangerous to retry
POST /orders {item:"book"} → creates a NEW order each time!
// Fix: use idempotency key
POST /orders {item:"book", idempotency_key:"abc123"}
// Server checks: already processed abc123? Return cached response.

HTTP Status Codes

RangeMeaningCommon Codes
2xxSuccess200 OK, 201 Created, 204 No Content
3xxRedirect301 Permanent, 302 Temporary, 304 Not Modified
4xxClient error400 Bad Request, 401 Unauthorized, 404 Not Found, 429 Too Many Requests
5xxServer error500 Internal Error, 502 Bad Gateway, 503 Service Unavailable
Key Takeaways