Api

REST, gRPC, GraphQL exchange format decision; HTTP methods; URL modeling; status codes; OAS; versioning; Postel's Robustness Principle; non-breaking vs breaking changes; implementation-as-de-facto-spec; version translation in controllers; API-first

Gateway taxonomy (enterprise/microservices/mesh), capabilities, pitfalls, history

REST vs gRPC vs GraphQL: decision table by traffic type; trade-off analysis across caching, schema, streaming, browser support, evolution; mixing protocols; chatty API anti-pattern

Test pyramid, consumer-driven contracts, Pact, component/integration/E2E testing; scope vs size distinction, test double fidelity hierarchy, user journey tests, formal verification with TLA+; EDM topology testing, integration testing strategies, event data sourcing

Strict/loose contract spectrum; consumer-driven contracts; stamp coupling; event schema evolution (forward/backward/full compatibility); schema registry; event design anti-patterns; Newman: structural vs semantic breakages, expansion changes, dual-version strategies; EIP: Format Indicator (version number/foreign key/embedded schema), Canonical Data Model

HTTP/1.1 vs HTTP/2 vs HTTP/3 (QUIC); multiplexing; HOL blocking; connection management; relationship to REST

Idempotency keys (atomicity requirement, principle of least astonishment), at-least-once delivery, retry safety

*Mastering API Architecture* — Gough, Bryant, Auburn

OAuth2 roles, JWT, grants (Auth Code, PKCE, Client Credentials), OIDC, refresh tokens

STRIDE, DREAD, OWASP API Top 10, six-step process, rate limiting strategies