Tag: REST-API

1. API Platform and OpenAPI: What Is Automatically Good and What You Must Override

   Apr 15, 2026

   API Platform generates OpenAPI documentation from PHP classes, which saves hours of manual work. But schema names with internal counters, missing examples, rudimentary security definitions and undocumented error cases show where the automation promise reaches its limits. This article shows concretely what works well, and what needs to be overridden.

   Read more

2. REST API Design: Cleanly Separating Resources, Verbs, Idempotency and Status Codes

   Apr 1, 2026

   Many REST APIs use HTTP as a transport protocol without ever tapping into its semantics. Resources modeled incorrectly, verbs misused, idempotency not guaranteed and status codes chosen arbitrarily, these are not questions of style but design errors with direct consequences for caching, retry logic and client implementation.

   Read more

3. Symfony Request DTOs and Response DTOs Instead of Arrays Everywhere

   Mar 29, 2026

   Arrays as request and response data containers are the most common maintenance problem in Symfony REST APIs: no type safety, no autocompletion, no documentation generated from the code. PHP 8.4 readonly properties, the Symfony Serializer and the Symfony Validator turn DTOs into a clear upgrade, with less code, more safety and better IDE support.

   Read more

4. Structuring OpenAPI YAML: components, Reuse, Naming and Versioning

   Mar 26, 2026

   An unstructured OpenAPI specification turns into a maintenance burden the moment more than three developers work on it. With components/schemas, consistent $ref references and a clear versioning strategy, the API description stays the single source of truth for documentation, code generation and contract tests.

   Read more

5. OpenAPI and Security Audits: What Auditors Really Want to See

   Mar 25, 2026

   Security auditors open an OpenAPI document with a clear checklist in mind: are all endpoints authenticated? Are error responses fully documented? Is input validated? Whoever understands this perspective builds API documentation that speeds up audits, reduces findings, and builds trust.

   Read more

6. REST API Security Review: Auth, Rate Limiting, Input Validation, SSRF and Mass Assignment

   Mar 19, 2026

   Insecure REST APIs are not a rare occurrence. They do not arise from bad intentions but from missing security layers in a growing codebase. Authentication gaps, missing rate limiting, unvalidated input, SSRF vectors and mass assignment weaknesses are the most common findings in API security reviews, and they can be closed systematically with clear patterns.

   Read more

7. OpenAPI Generator in CI: Generating Client SDKs and Stubs Automatically

   Mar 3, 2026

   Manually generating client SDKs from an OpenAPI spec is error-prone and blocks releases. Running openapi-generator inside a CI/CD pipeline generates, validates and publishes SDKs automatically on every spec change, with Spectral linting, breaking change detection and contract tests acting as gates.

   Read more

8. Describing File Uploads and Downloads Cleanly in OpenAPI

   Feb 26, 2026

   OpenAPI specifications for file operations frequently contain errors: misused format values, missing encoding objects and undocumented response headers for downloads. This article shows how to model uploads and downloads precisely in OpenAPI 3.1, so that client generators produce correct code and integrators encounter no surprises.

   Read more

9. Swagger UI, Redoc, Scalar and Stoplight Compared

   Feb 21, 2026

   Choosing the right documentation UI for a REST API is not a minor decision. It affects how quickly external developers get up to speed on the API, whether consumer teams can try out endpoints directly, and how much effort integrating it into the CI pipeline costs. Swagger UI, Redoc, Scalar and Stoplight Elements each bring different strengths and philosophies to the table.

   Read more

10. Using OpenAPI and Postman Together Without Duplicate Maintenance

    Feb 16, 2026

    Anyone who maintains Postman collections by hand while also managing an OpenAPI specification doubles the effort on every API change. With the right import workflow, automatic synchronization and Newman CLI, the OpenAPI specification becomes the single source, for documentation, testing and CI integration.

    Read more