Page 10 - REST-API

A breaking change in a public API rarely happens on purpose, it usually slips in through an unremarkable pull request that was only supposed to fix an internal bug. Diff tools like oasdiff and openapi-diff compare two versions of an OpenAPI specification automatically and reliably catch exactly these contract breaks before they get merged. This article explains the difference to plain Spectral linting, how to set up a concrete CI gate, and how deliberately intended breaking changes get documented and approved through a whitelist mechanism.

A REST API that runs in production but cannot be observed is a black box. Structured logging, distributed tracing with OpenTelemetry and Prometheus metrics are the three pillars that let teams localize errors, explain latency spikes and plan capacity, without digging through log files.

CORS errors in the browser console rank among the most frustrating debugging experiences for frontend developers, and the obvious, quick fix, setting Access-Control-Allow-Origin to *, usually works immediately but undermines exactly the security mechanism CORS is supposed to provide. A deeper understanding of the underlying preflight and simple request mechanics allows configuring CORS deliberately and securely, instead of disabling it wholesale.

A resilient Amazon and eBay integration is more than a product export: Magento has to act as the single source of truth for product data, while the marketplace stays authoritative for orders. This article walks through the architecture of a custom-built marketplace integration using Service Contracts, queue-based order sync and rate-limit handling for Amazon SP-API and eBay Trading API.

Not every asynchronous requirement needs webhooks. Polling is sometimes the more sensible choice. And REST callbacks exist as a hybrid approach that many teams don't know about. Whoever understands the difference makes better architecture decisions, and doesn't build webhook infrastructure where a simple 30-second poll would be the cleaner solution.

A REST API without correctly documented security requirements is a black box for consumers. OpenAPI 3.x offers four security scheme types that can be made directly usable in the Swagger UI, if you know how to model them correctly, combine them globally and endpoint-specifically, and control them granularly with scopes.

Anyone who thinks API Platform only works with Doctrine entities has not yet met the State Provider and the State Processor. These two interfaces fully decouple reading and writing from the persistence layer and let you expose REST endpoints, legacy systems, or purely computed values as first class API resources.

Once a system exchanges asynchronous messages over RabbitMQ, Kafka, or WebSockets, a description like OpenAPI's is missing: which messages flow over which channel, in what format, with what payload structure. AsyncAPI closes exactly that gap, with a specification deliberately modeled after OpenAPI.

Hand-written TypeScript interfaces for REST endpoints quietly go stale as the backend evolves, offering false type safety instead of real protection against runtime errors. This article shows how openapi-typescript and related tools generate TypeScript types and typed fetch clients directly from an OpenAPI specification, and how to wire that process reliably into build and CI pipelines.

A backoffice API and a public API share HTTP as transport, but their requirements for stability, backward compatibility, security, and error models differ so fundamentally that a unified design inevitably makes one of the two worse.