Page 12 - REST-API

Schema definition, query language, mutations, and resolvers are the four load-bearing pillars of every GraphQL system. Anyone who understands how they work together and where the typical mistakes happen builds APIs that scale, instead of APIs that have to be rebuilt after the first release to production.

A complete OpenAPI specification allows automatically generating client SDKs for dozens of programming languages, instead of manually maintaining them for every target language. But merely running a codegen tool rarely produces an SDK that actually feels pleasant to developers from the start, which is why real quality only emerges through deliberate additional work on the specification and generator configuration.

When frontend and backend define their own independently maintained types for the same API, both sides eventually drift apart, and the bug only surfaces at runtime for the customer. A shared contract package in a TypeScript monorepo makes such deviations visible at compile time instead.

Anyone who only checks WebSocket endpoints in the browser with DevTools loses reproducibility and automatability. With openssl, curl and websocat, you can test WebSocket connections with Bash, walk through the handshake by hand, and wire connection checks straight into the CI pipeline.

The classic OAuth2 Authorization Code Flow assumes the client can open a browser and receive a redirect, which practically doesn't work for a CLI tool, a smart TV, or an IoT device without an on-screen keyboard. The OAuth2 Device Authorization Grant, specified in RFC 8628, solves this problem by having the user perform authorization on a separate device with a full-featured browser, while the original device waits in the background for the result.

Compression is essentially always worth enabling for REST APIs, since JSON compresses exceptionally well, the real question is which algorithm to use where. Gzip is the safe, universal default, Brotli gets meaningfully better ratios but at a CPU cost that only pays off in the right circumstances.

Anyone who designs REST APIs without clear patterns builds in inconsistencies that multiply over months. Shaping resource structure, status codes, error formats, pagination and versioning according to proven patterns separates APIs that survive in production from ones that produce breaking changes with every release.

Contract testing with Pact replaces expensive end to end tests across service boundaries with fast, isolated checks. The consumer defines its expectations of an interface as a machine readable contract, which the provider automatically verifies in its own CI pipeline. This catches incompatible API changes between frontend and backend long before they affect customers in production.

How to model filter and sort arguments as clean input types, implement operator patterns for different data types, use Magento's filter conventions, and choose the right pagination strategy for each use case.

Teams that maintain API tests in a separate tool and E2E tests in Cypress or Playwright double their maintenance effort and lose context between the two worlds. With cy.request() and Playwright's APIRequestContext, test data can be built in milliseconds instead of through forms, auth sessions can be shared between API and browser, and entire test suites can be noticeably accelerated without losing reliability.