Page 9 - REST-API

Offset pagination with OFFSET and LIMIT looks simple at first glance, but returns shifted, duplicate, or skipped entries once the underlying data changes between two requests. Cursor-based pagination (also called keyset pagination) fixes this structurally by anchoring every page to an actual record instead of a numeric position, through an opaque token built from a sort key and a unique id.

Anyone who builds a REST or GraphQL API in Symfony by hand ends up writing controllers, serializer configuration, pagination and error handling themselves. API Platform 4 handles all of that declaratively. A PHP class with the right attribute is enough to get a complete API resource with filtering, pagination and OpenAPI documentation.

Poor API error responses cost development time, on both sides. When consumers only get {"error": "Something went wrong"}, they can neither react programmatically nor debug in a targeted way. RFC 9457 Problem Details for HTTP APIs, machine-readable error codes, structured field errors and correlation IDs turn error cases into a first-class feature of the API, not an afterthought.

Without a deliberate API versioning strategy, every breaking change turns into a crisis meeting with external integrators. In PHP, three established approaches are available: a version number in the URI, a dedicated version header, or versioning through the Accept header via content negotiation. Which API versioning approach fits depends on your customer structure, release rhythm and the number of versions supported in parallel.

Documentation that diverges from the code is worse than no documentation at all. Anyone who doesn't maintain OpenAPI schemas, validation rules, and example values in a structured way in Symfony builds up technical debt that discharges with every breaking change. This article shows how to keep schemas, examples, and validation permanently in sync.

Hono is built consistently on Web Standard APIs like Request and Response instead of Node specific types, so it runs unchanged on Cloudflare Workers, Deno, Bun and Node.js. Its built in RPC mode derives client types directly from the server definition, with no code generation or separate schema at all.

A webhook endpoint is technically nothing more than a publicly reachable URL that accepts POST requests. Anyone who knows that URL could, in theory, inject forged events if the receiver never checks the authenticity of incoming requests. HMAC-SHA256 signatures over the payload, combined with a timing-safe comparison function and replay protection via a timestamp, close that gap reliably. This article walks through the practical implementation step by step, including a complete Symfony middleware example.

Once a REST API needs to deliver real-time updates, such as live order status, notifications, or price changes, teams face a choice between Server-Sent Events and WebSockets. Both solve the problem that classic HTTP polling creates unnecessary latency and load, but they differ fundamentally in protocol overhead, direction of data flow, and implementation complexity, which is why the choice significantly affects the long-term maintenance cost of an API extension.

The most expensive mistake in a multi-tenant API is not a missing feature, it is a single forgotten WHERE clause that hands one tenant's data to another. This article compares the three established isolation models, row-level isolation, schema-per-tenant, and database-per-tenant, weighs whether the tenant ID belongs in a JWT, a header, or the URL, and describes how to structurally prevent cross-tenant access in a Symfony project instead of relying on every individual developer's discipline.

Rate limiting is often treated as a one-line library function, without questioning which algorithm actually runs behind it. But the choice between fixed window, sliding window, token bucket, and sliding log has very different effects on how well a system absorbs real load spikes and how fairly limits are distributed between users.