26. lets build APIs without the clutter, they said
27. example: the http://joind.in/ API
28. POST /api/talk HTTP/1.1Host: joind.inContent-‐Type: text/xml; charset=utf-‐8<?xml version="1.0" encoding="UTF-‐8"?><request> <auth> <user>Chuck Norris</user> <pass>roundhousekick</pass> </auth> <action type="getdetail"> <talk_id>42</talk_id> </action></request>HTTP/1.1 200 OKContent-‐Type: text/xml; charset=utf-‐8<?xml version="1.0" encoding="UTF-‐8"?><response> <item> <talk_title>My Test Talk</talk_title> <talk_desc>This is a sample talk description</talk_desc> <ID>42</ID> </item></response>
29. PROBLEMS WITH THIS API• Always a POST• Doesnt use HTTP Authentication• Operation information is enclosed in the request ("getdetail")• Nothing there is cacheable• Everything through one endpoint (/api/talks for talks)
30. Level 0 in the Richardson Maturity Model: Plain old XML over the wire in an RPC fashion
31. Room for improvement: use one URI for each resource.
32. That would be Level 1 in Richardsons Maturity Model
33. Level 0 and Level 1 are a bag of hurt. Do not use them. Ever.
34. ALONG CAME ROY FIELDING And Gave Us REST
35. that was awesome
36. because everyone could say
37. I haz REST nao
38. when in fact
39. they bloody didn’t
40. RESTWhat Does That Even Mean?
41. REpresentational State Transfer
42. Roy Thomas Fielding: Architectural styles andthe design of network based software architectures.
45. UNIFORM INTERFACE•A URL identiﬁes a Resource• Methods perform operations on resources• The operation is implicit and not part of the URL•A hypermedia format is used to represent the data• Link relations are used to navigate a service
46. a web page is not a resource
47. it is a (complete) representation of a resource
52. AND FINALLY, HTMLGET /products/ HTTP/1.1Host: acme.comAccept: application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,*/*;q=0.5User-‐Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-‐us) AppleWebKit…HTTP/1.1 200 OKContent-‐Type: text/html; charset=utf-‐8Allow: GET, POST<html lang="en"> <head> <meta http-‐equiv="Content-‐Type" content="text/html; charset=UTF-‐8"></meta> <title>ACME Inc. Products</title> </head> <body> <h1>Our Incredible Products</h1> <ul id="products"> <li><a href="http://acme.com/products/1234">Red Stapler</a> (€3.14)</li> </ul> </body></html>
53. VOLUME ONEDesigning an HTTP Interface
54. FIRST: DEFINE RESOURCES A Good Approach: Structure Your URLs
55. BAD URLS• http://www.acme.com/product/• http://www.acme.com/product/ﬁlter/cats/desc• http://www.acme.com/product/1234 WTF?• http://www.acme.com/photos/product/1234 new what?• http://www.acme.com/photos/product/1234/new sausage ID?• http://www.acme.com/photos/product/1234/5678
56. GOOD URLS a list of products• http://www.acme.com/products/ filtering is a query• http://www.acme.com/products/?ﬁlter=cats&sort=desc a single product• http://www.acme.com/products/1234 all photos• http://www.acme.com/products/1234/photos/• http://www.acme.com/products/1234/photos/?sort=latest• http://www.acme.com/products/1234/photos/5678
57. now heres the ironic part
58. URLs dont matter once you have a fully RESTful interface
59. but it’s helpful to think in terms of resources
60. SECOND: USE RESOURCES CRUD, but not really
61. COLLECTION OPERATIONS• http://www.acme.com/products/ • GET to retrieve a list of products • POST to create a new product • returns • 201 Created • Location: http://www.acme.com/products/1235
62. ITEM OPERATIONS• http://www.acme.com/products/1234 • GET to retrieve • PUT to update • DELETE to, you guessed it, delete
63. and remember
64. dont let the server maintain client state (e.g. cookies)
65. Now we are at Level 2 in RMM
66. RMM LEVEL 2• Use HTTP verbs • GET (safe and idempotent) • POST (unsafe, not idempotent) • PUT & DELETE (unsafe, idempotent)• Use HTTP status codes to indicate result success • e.g. HTTP/1.1 409 Conﬂict
67. THE TWITTER APINot RESTful, And Not Even Getting HTTP Right :(
68. mind you were not even inspecting the RESTfulness
69. were just looking at Twitters API from an HTTP perspective
70. STATUSES/SHOW• GET http://api.twitter.com/1/statuses/show/12345.json• Problems: • Operation (“show”) included in the URL • Status ID not a child of the “statuses” collection• Better: GET http://twitter.com/statuses/12345 with Accept header
71. STATUSES/UPDATE• POST http://api.twitter.com/1/statuses/update.json• Problems: • Operation (“update”) included in the URL • Uses the authenticated user implicitly• Better: POST http://twitter.com/users/CaseySoftware/statuses/
72. STATUSES/DESTROY• POST http://api.twitter.com/1/statuses/destroy/12345.json• Problems: • Operation (“destroy”) included in the URL like it’s 1997 • Odd, illogical hierarchy again • Allows both “POST” and “DELETE” as verbs• Better: DELETE http://twitter.com/statuses/12345
73. STATUSES/RETWEETS• GET http://api.twitter.com/1/statuses/retweets/12345.json• Problems: • Hierarchy is wrong• Better: GET http://twitter.com/statuses/12345/retweets/
74. STATUSES/RETWEET• PUT http://api.twitter.com/1/statuses/retweet/12345.format• Problems: • “retweets” collection exists, but is not used here • As usual, the action is in the URL (“make retweet” is RPC-y) • Allows both “PUT” and “POST” as verbs• Better: POST http://twitter.com/statuses/12345/retweets/
75. SUMMARY• http://twitter.com/statuses/ • POST to create a new tweet• http://twitter.com/statuses/12345 • DELETE deletes (PUT could be used for updates)• http://twitter.com/statuses/12345/retweets/ • POST creates a new retweet
76. ANGRY GERMAN SUMMARY• Twitters "REST" API sucks, hates HTTP and kills baby kittens.
77. INTERMISSIONWhats the Biggest Reason for the Success of the Web?
79. ﬁrst data exchange system
80. planetary scale
81. why is that possible?
83. no tight coupling!
84. loosely coupled by design
85. no notiﬁcation infrastructure
86. HTTP/1.1 404 Not Found
87. embraces failure
88. more information != more friction
89. no limits to scalability
90. WWW is protocol-centric
91. VOLUME TWORESTful Services with Hypermedia
92. THE UNIFORM INTERFACE• Identiﬁcation of Resources (e.g. through URIs) • Representations are conceptually separate!• Manipulation Through Representations (i.e. they are complete)• Self-Descriptive Messages (containing all information)• Hypermedia As The Engine Of Application State ("HATEOAS") magic awesomesauce essential to REST
93. HATEOASThe Missing Piece in the Puzzle
94. ONE LAST PIECE IS MISSING• How does a client know what to do with representations?• How do you go to the “next” operation?• What are the URLs for creating subordinate resources?• Where is the contract for the service?
95. HYPERMEDIA AS THE ENGINE OF APPLICATION STATE• Use links to allow clients to discover locations and operations• Link relations are used to express the possible options• Clients do not need to know URLs, so they can change• The entire application workﬂow is abstracted, thus changeable• The hypermedia type itself could be versioned if necessary• No breaking of clients if the implementation is updated!
96. (X)HTML and Atom are Hypermedia formats
97. Or you roll your own...
98. A CUSTOM MEDIA TYPEGET /products/1234 HTTP/1.1 Remind clients ofHost: acme.comAccept: application/vnd.com.acme.shop+xml Uniform Interface :) re-use Atom forHTTP/1.1 200 OKContent-‐Type: application/vnd.come.acme.shop+xml; charset=utf-‐8 link relationsAllow: GET, PUT, DELETE<?xml version="1.0" encoding="utf-‐8"?><product xmlns="urn:com.acme.prods" xmlns:atom="http://www.w3.org/2005/Atom"> <id>1234</id> <name>Red Stapler</name> <price currency="EUR">3.14</price> <atom:link rel="payment" type="application/vnd.com.acme.shop+xml" href="http://acme.com/products/1234/payment"/></product> meaning defined in IANA Link Relations list
99. boom, RMM Level 3
100. XML is really good for hypermedia formats
101. (hyperlinks, namespaced attributes, re-use of formats, …)
102. JSON is more difﬁcult
103. (no hyperlinks, no namespaces, no element attributes)
118. ROOM FOR IMPROVEMENT IN THE LOVEFILM API• Uses application/xml instead of a custom media type • Once that is ﬁxed, all the link elements could also have a “type” attribute indicating the media type• Shoulduse XML namespaces on the root element, with one namespace per type (e.g. “urn:com.loveﬁlm.api.item”, “urn:com.loveﬁlm.api.searchresult” and so on) • That way, clients can determine the resource type easily
121. ROOM FOR IMPROVEMENT IN THE HUDDLE API• Uses custom rels like “thumb” or “avatar” not deﬁned in the IANA registry (http://www.iana.org/assignments/link-relations) • Risk of collisions and ambiguity; should use something like “http://rels.huddle.net/thumb” instead.• Uses one global XML schema and namespace for all entities • Clients cannot detect entity type based on namespace • Difﬁcult to evolve schema versions independently
122. API VERSIONING Media Types To The Rescue!
123. why not api.myservice.com/v1/foo/bar?and then api.myservice.com/v2/foo/bar?
135. or what if another forum software wants the same API?
136. also would have to use “/v1/” in their URLs
137. URI based versioning kills interoperability
138. YOU MIGHT BE WONDERING Why Exactly Is This Awesome?
139. THE MERITS OF REST• Easyto evolve: add new • Easyto implement: build it features or elements without on top of HTTP, and proﬁt! breaking BC • Authentication & TLS• Easy to learn: developers can "browse" service via link rels • Caching & Load Balancing• Easyto scale up: grows well • Conditional Requests with number of features, users and servers • Content Negotiation
141. hold on, you say
142. a plain HTTP-loving service does the job, you say
143. surely, there is a merit to REST beyond extensibility, you ask
145. "REST is software design on the scale of decades: everydetail is intended to promote software longevity andindependent evolution. Many of the constraints aredirectly opposed to short-term efﬁciency. Unfortunately,people are fairly good at short-term design, and usuallyawful at long-term design." Roy Fielding
146. "Most of RESTs constraints are focused on preservingindependent evolvability over time, which is onlymeasurable on the scale of years. Most developerssimply dont care what happens to their product yearsafter it is deployed, or at least they expect to be aroundto rewrite it when such change occurs." Roy Fielding
147. FURTHER READING• Ryan Tomayko How I Explained REST to my Wife http://tomayko.com/writings/rest-to-my-wife• Jim Webber, Savas Parastatidis & Ian Robinson How to GET a Cup of Coffee http://www.infoq.com/articles/webber-rest-workﬂow• Roy Thomas Fielding Architectural Styles and the Design of Network-based Software Architectures http://www.ics.uci.edu/~ﬁelding/pubs/dissertation/top.htm
148. BOOKS ON REST• Jim Webber, Savas Parastatidis, Ian Robinson REST in Practice ISBN: 978-0596805821• Subbu Allamaraju RESTful Web Services Cookbook ISBN: 978-0596801687• Leonard Richardson, Sam Ruby RESTful Web Services ISBN: 978-0596529260
149. !e End
151. THANK YOU! This was http://joind.in/6395 by @dzuelkeSend me questions or hire us:firstname.lastname@example.org