Page 7 - REST-API

Most REST resources carry far more fields than a given client actually needs, and nested resources make that worse by pulling in entire related objects. A generic ?fields= parameter with dot-notation support solves this once, centrally, in the serializer, instead of being reimplemented for every endpoint.

Pagination looks like a trivial detail at first, yet in API Platform it decides response times on large tables, consistency under concurrent writes, and ergonomics for client developers. Anyone who only knows the default offset pagination gives away performance and risks duplicate or missing records on heavily used endpoints.

Postman Collections are, for many development teams, the first stop for practically trying out a REST API, even before reading the actual documentation. But a collection maintained manually alongside actual API development almost inevitably goes stale, once a developer under time pressure forgets to update it after an API change, which is why automated generation from the same OpenAPI specification also used for SDKs and server-side validation is the only reliable way to ensure lasting synchronization.

HATEOAS turns a PHP API into a real state machine: instead of clients building URLs themselves, every response ships the links that are actually allowed in the current state. This article shows a practical HATEOAS implementation in PHP with the HAL format, a custom link builder, and concrete examples from an order process.

In production systems, GraphQL is not a query format, it is an architecture topic. Anyone who writes elegant queries but ignores resolver depth, N+1 problems, complexity limits and caching builds APIs that break under load. These 50 patterns show what actually works in real GraphQL projects.

A REST API without a test strategy is a promise without a guarantee. Symfony offers a complete ecosystem for every test layer with HttpClient, Panther and PHPUnit, from fast unit tests for validation logic to contract tests that make sure API consumers and API providers speak the same interface specification.

NestJS combines TypeScript decorators, dependency injection and a modular architecture into a backend framework that enforces structure instead of leaving it to chance. Learning TypeScript with NestJS means understanding modules, controllers, providers, DTOs and guards as one connected system, not a loose collection of functions.

When a client needs to create or update hundreds of entities, hundreds of individual HTTP requests are inefficient, both in network overhead and server load. A well-designed bulk endpoint drastically reduces this overhead, but brings its own design challenge: how do you communicate when some items in a batch succeed and others fail?

An OpenAPI specification that no longer matches the implementation is worse than no documentation at all, it lies to you. Contract testing closes that gap automatically: tests check on every commit whether the backend implementation still honors the contract the specification defines.

A network error after a successful payment leads, without protection, to the client repeating the same request and triggering a second payment. This article shows how idempotency keys are implemented in PHP APIs to reliably prevent exactly this problem, including request fingerprinting, response caching, and protection against race conditions.