api-engineering

REST API design requires defining contracts with OpenAPI, implementing versioning through URI, header, or query parameters, and adding rate-limiting middleware using token bucket or sliding window approaches to protect endpoints and manage traffic across teams.

GraphQL schema design uses resolvers with DataLoader techniques to batch and cache queries, preventing N+1 performance issues. Proper resolver implementation reduces database hits and improves response latency for nested field resolution.

API versioning strategies trade-off between discoverability and URL cleanliness. URI versioning (/v1/, /v2/) is explicit and cacheable; header versioning keeps URLs clean but less discoverable; query-based versioning offers flexibility. SemVer guidance aligns versioning with API contract changes.

API gateway configurations enforce authentication at the perimeter and authorization at route or policy levels. Best practices include token validation, role-based access control, secure credential handling, and centralized policy application across all downstream services.

Rate limiting with token bucket or sliding window algorithms prevents abuse by controlling request rates per client. Proper configuration using quotas, burst allowances, and graceful degradation protects API availability while accommodating legitimate traffic spikes.

Secure API design includes schema validation against OpenAPI or GraphQL contracts, sanitizing inputs, returning standardized error responses with appropriate HTTP status codes, and avoiding information leakage in error messages to prevent exploitation.