APIs and REST Flashcards

What is the purpose of a webhook in API design?

Answer: To allow a server to push event notifications to a client URL

Webhooks enable server-to-client push notifications by calling a client-provided URL when a specific event occurs, avoiding polling.

What does CORS stand for and why does it matter for APIs?

Answer: Cross-Origin Resource Sharing; controls which domains can access the API from a browser

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts which origins can make requests to your API.

Which HTTP status code should a REST API return when a client sends an invalid request body?

Answer: 400 Bad Request

400 Bad Request indicates the server cannot process the request due to client-side errors such as malformed syntax or invalid parameters.

What is the role of an API gateway in a microservices architecture?

Answer: It acts as a single entry point, handling routing, auth, and rate limiting

An API gateway is a reverse proxy that sits in front of microservices, centralizing cross-cutting concerns like authentication, rate limiting, and load balancing.

In OpenAPI (Swagger) specification, what is a 'schema'?

Answer: A description of the structure and validation rules for request/response data

In OpenAPI, a schema defines the shape, data types, and constraints of request bodies, response objects, and query parameters.

What is the key difference between OAuth 2.0 and API Keys for authentication?

Answer: OAuth 2.0 provides delegated access with scopes; API keys are static credentials

OAuth 2.0 enables fine-grained delegated authorization with scopes and token expiry, while API keys are simple static credentials with no built-in scope control.

What does the 'Retry-After' HTTP header communicate to API clients?

Answer: How long the client should wait before making another request

Retry-After tells clients how long to wait (in seconds or until a specific date) before retrying after a 429 or 503 response.