Command Palette

Search for a command to run...

Hectal
Roadmap
Phase 6BIntermediate9 of 19 in the curriculum

API Design & Identity

Designing APIs other teams love to use, and knowing who is calling them: resource design, pagination, versioning, idempotency and errors, REST vs GraphQL vs gRPC, authentication (sessions, JWT, OAuth 2.0, OIDC, SSO), and authorization (RBAC, ABAC, ReBAC).

Almost every design interview includes 'define the API', and almost every real outage postmortem includes an API that broke a client or let the wrong user in. This phase turns Phase 6's protocols into contracts you can defend.

0/7 · 0%
7 topics ~49 min 6 code blocks & diagrams
Start with the first topic
1
6B.1

REST Resource Design

Model your API around resources (nouns) and use HTTP methods as the verbs. Consistent naming, status codes, and error shapes make an API predictable, and predictable APIs get integrated faster and break less.

7 min 1 code practice

2
6B.2

Pagination, Filtering & Sorting at Scale

Any list can grow to millions of items. Offset pagination is simple but slow and inconsistent at depth; cursor (keyset) pagination is stable and fast. Filtering and sorting must line up with database indexes.

7 min 1 code practice

3
6B.3

Versioning & Evolving APIs Without Breaking Clients

APIs live longer than the code behind them. Evolve them with additive, backward-compatible changes; when you must break, version explicitly, run both versions, and retire the old one with deprecation notices and data.

6 min practice

4
6B.4

Idempotency Keys, Timeouts & Safe Retries

Networks fail after the server did the work but before the client heard back. Idempotency keys let clients retry 'create payment' safely; timeouts and retry rules keep one slow dependency from taking everything down.

7 min 1 code practice

5
6B.5

REST vs GraphQL vs gRPC vs Events

Four ways to shape an API, each best at something: REST for public resource APIs, GraphQL for flexible client-driven queries, gRPC for fast typed service-to-service calls, and events for asynchronous decoupling.

7 min 1 code practice

6
6B.6

Authentication: Sessions, JWT, OAuth 2.0, OIDC & SSO

Authentication answers 'who is calling?'. Sessions and tokens carry that answer between requests; OAuth 2.0 delegates access; OpenID Connect adds login on top; SSO lets one identity provider serve every app.

8 min 1 diagram practice

7
6B.7

Authorization: RBAC, ABAC, ReBAC & Multi-Tenant Access

Authorization answers 'is this caller allowed to do this to that?'. Roles are the simple start, attributes add context, relationships model sharing, and every check must also enforce tenant boundaries.

7 min 1 code practice