API
114 bites tagged API — interview questions with model answers, and 60-second explainers.
FastAPI: Reading Request Cookies
FastAPI treats request cookies like any other parameter. Declare them directly in your endpoint's function signature using `Cookie()`, and the framework will extract the value for you. Use this for reading session IDs or user preferences.
Declaring Request Headers in FastAPI
Treat request headers like any other parameter in FastAPI. Declare them in your function signature to access values like `User-Agent` or `X-Token`. FastAPI automatically converts hyphens to underscores, so `User-Agent` is accessed via the `user_agent`…
FastAPI: Use HTTPException to Return Client Errors
FastAPI's HTTPException is your tool for stopping an operation and sending a clean HTTP error. Raise it when business logic fails, like a missing database record. The footgun is catching it yourself; just `raise` it and let FastAPI do the rest.
FastAPI: Set a Response's HTTP Status Code
In FastAPI, set the success status code in the decorator, not the function. Use `status_code=201` in `@app.post()` to signal resource creation. The common footgun is placing `status_code` in the function signature instead of the decorator itself.
FastAPI: Validate Parameters with Query and Path
FastAPI's `Query` and `Path` objects let you declare rich validation rules directly in your function's signature. Enforce string lengths, regex patterns, or numeric ranges on URL parameters without writing manual checks.
FastAPI: Automatic Interactive API Docs
FastAPI turns your Python type hints into live, interactive API documentation. It generates an OpenAPI schema to power a UI where you can test endpoints directly from your browser, no extra work needed.
FastAPI Response Models: Shape Your API's Output
A FastAPI `response_model` defines your API's output shape, acting as a data filter and automatic documentation generator. Use it to prevent data leaks and provide clear schemas.
FastAPI: Pydantic for Robust Request Bodies
A Pydantic model is a contract for your API's request body. It tells FastAPI what data to expect, automatically converting incoming JSON into a typed Python object. Use this for any POST or PUT endpoint. The footgun is declaring path params in the body model.
FastAPI Query Parameters: Beyond the URL Path
In FastAPI, function arguments not in the URL path become query parameters—the optional key-value pairs after a URL's `?`. Use them for filtering or pagination, like `/items?skip=0&limit=10`. The footgun: omitting a default value makes the parameter required.
Path Parameters: Turning URL Parts into Variables
Path parameters turn parts of a URL, like `/users/123`, into typed function arguments. FastAPI uses this to create endpoints for specific resources, like fetching a user by their ID. The footgun is forgetting type hints; without `int`, `123` is just a string.
FastAPI: Configure Endpoints with Decorators
FastAPI's path operation decorators configure an endpoint's metadata and behavior. Use them to set status codes (status_code=201), group endpoints with `tags`, or mark them as `deprecated`.
FastAPI Application Instance: Your API's Central Hub
The FastAPI instance is your API's central switchboard, connecting incoming requests to your code. You create it once (e.g., `app = FastAPI()`) and use its decorators like `@app.get` to define all your endpoints. The footgun is creating multiple instances.
SDKs: A Strategy to Make Your Platform the Default
An SDK is a strategic tool to drive adoption. By bundling compilers and frameworks, you make it easy for developers to build for your platform or integrate your service, making your ecosystem the path of least resistance.
Open vs. Closed Platforms: Walled Garden or Public Park?
An open platform is a public park, inviting others to build on it; a closed one is a walled garden with total control. This choice defines growth: via a third-party ecosystem (Android) or tight integration (Apple).
API-as-a-Product: Your API Is Your Business
Treat your API as a core product with developers as your customers, not just a technical integration. This mindset is crucial when exposing data to partners or building a developer ecosystem, like Stripe or Twilio do.
Never Trust Client Input: API Validation
Think of API validation as a bouncer for your server, checking every incoming request's ID before it can access your application logic. Use it in any Express route that accepts user input to prevent bad data from hitting your database or causing errors.
Joi: Declarative Schemas for Data Validation
Joi lets you describe your data's shape with a readable schema instead of writing manual validation logic. It's used to validate API request bodies or config files.
OAuth 2.0: Delegated Authorization, Not Authentication
Think of OAuth 2.0 as a valet key for your data. It lets a third-party app access specific resources on your behalf without you sharing your password. It's used for "Log in with Google" or letting an app access your photos.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
HATEOAS: Let Your API Tell You What's Next
HATEOAS makes an API self-discoverable, like a website where you click links instead of guessing URLs. The server's response includes links for the next possible actions, decoupling the client from hardcoded endpoints.
API Rate Limiting: Protecting Your Express Endpoints
Rate limiting acts as a bouncer for your API, preventing any single user from overwhelming it. It's crucial for public APIs and sensitive endpoints like password resets to block abuse. The default in-memory store won't work across multiple server instances.
API Versioning: Managing Change Without Breaking Clients
API versioning lets you evolve an API without breaking existing clients. It's essential for public APIs or services with multiple frontends that can't update in lockstep. The footgun is delaying versioning, forcing a painful migration on early users.
HTTP Status Codes: The Server's Signal
HTTP status codes are the server's signal for a request's outcome: success, client error, or server error. You see them when fetching data (200 OK), hitting a bad link (404), or when a server fails (500). Footgun: Don't just check for 'not 200'.
REST: The Architectural Style of the Web
REST is a set of design rules, not a strict protocol, for building massive distributed systems like the web. These constraints enable independent component deployment, scalable interactions, and a layered architecture that supports caching and security.
Get API bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.