REST APIs: integrate applications and diagnose failures

Objectives and progression

A six-module technical course on designing and operating HTTP APIs with REST principles. Learn to interpret contracts, manage concurrency and retries, check authorization, and observe business outcomes. Includes fictional integration and APS scenarios, primary standards and explicitly scoped provider contracts, and an internal assessment of 24 decisions in 60 minutes.

Audience: APS L2/L3, infrastructure, SRE, systems administration teams, and technical managers.

Prerequisites: Application, monitoring, and production-support fundamentals; no bank-specific internal process assumed.

300 estimated study minutes

• Define representations and compatibility boundaries before integrating systems.
• Distinguish technical acceptance, completion, and actionable errors.
• Avoid duplicates and lost updates without promising universal exactly-once execution.
• Evaluate subject, operation, and object on every access.
• Control response reuse and traversal of changing collections.
• Measure outcomes, bound retries, and prepare contract transitions.

Modules

1. API resources and contracts
2. Requests and outcomes
3. Concurrency and retries
4. Authorization and boundaries
5. Caching and pagination
6. Operations and evolution

Continue learning

Technical assessments

• HTTP / HTTPS
• Microservices
• Monitoring and Observability
• System Design

References and version

HTTP semantics RFC9110; OpenAPI3.2.1; selected primary standards and provider contracts consulted2026-09-30

• REST architectural style, dissertation chapter5 · 2026-09-30
• RFC9110 HTTP Semantics · 2026-09-30
• RFC9111 HTTP Caching · 2026-09-30
• RFC9457 Problem Details for HTTP APIs · 2026-09-30
• OpenAPI Specification3.2.1 · 2026-09-30
• RFC5789 PATCH Method for HTTP · 2026-09-30
• RFC6902 JavaScript Object Notation JSON Patch · 2026-09-30
• RFC6585 Additional HTTP Status Codes · 2026-09-30
• API1:2023 Broken Object Level Authorization · 2026-09-30
• API5:2023 Broken Function Level Authorization · 2026-09-30
• RFC9700 Best Current Practice for OAuth2.0 Security · 2026-09-30
• Trace Context · 2026-09-30
• Fetch Standard · 2026-09-30
• AIP158 Pagination · 2026-09-30
• Idempotent requests · 2026-09-30
• RFC9745 The Deprecation HTTP Response Header Field · 2026-09-30
• RFC8594 The Sunset HTTP Header Field · 2026-09-30