11. To the
Level 0:
Level 1:
Swamp of POX
Resources
glory Level 2:
Level 3:
Verbs
Hypermedia
of
REST
12. > POST /api HTTP/1.1
> <SOAP-ENV:Envelope ...>
<SOAP-ENV:Body>
<m:getAvailableDataSources xmlns:m="
Swamp
<group xsi:type="xsd:string">ArcWe
<service xsi:type="xsd:string">Map
<token xsi:type="xsd:string">MyTok
</m:getAvailableDataSources>
of POX
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
< HTTP/1.1 200 OK
< <?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope ...>
<soap:Body>
<n:getAvailableDataSourcesResponse x
<Result href="#id0"/>
</n:getAvailableDataSourcesResponse>
All things go over the <id0 id="id0" soapenc:root="0" xsi:t
soapenc:arrayType="ns5:DataSource[21]">
same endpoint as XML <i href="#id1"/>
--snip--
13. RESOURCES
> GET https://ec2.amazonaws.com/?Action=DeleteVolume&VolumeId=vol-4282672b HTTP/1.1
< HTTP/1.1 200 OK
<DeleteVolumeResponse xmlns="http://ec2.amazonaws.com/doc/2012-08-15/">
<requestId>59dbff89-35bd-4eac-99ed-be587EXAMPLE</requestId>
<return>true</return>
</DeleteVolumeResponse>
--snip--
Many URIs, same HTTP method
Side-effects are API-specific
14. VERBS
> HEAD https://mybucket.s3.amazonaws.com/ HTTP/1.1
< HTTP/1.1 200 OK
HTTP verbs mean more than CRUD
Status codes are meaningful
17. abort
add
alternate
disk:attach
TRANSITIONS edit
remove
task
All transitions are discoverable via links
18. CONTENT
NEGOTIATION
➡ Client supplies representation in
Accept header
➡On change, update mediatype
name or annotate via ;version=N.N
➡On overhaul, bump global version
Accept: application/vnd.VENDOR.PRODUCT.RESOURCE+xml
30. GOOD API DESIGNERS
UNDERSTAND
how it is used, and who will use it
importance of iterations and feedback
impacts to design beyond development
there’s no golden hammer (not even mongo)
32. AWS IS NOT REST
AWS IS GOOD
api designed to parse quickly
simple extension (add new key)
consistent security model
bulk ops
33. WebSockets
ain’t even
HTTP! Handshake is HTTPish
Discoverable like ReST
Full-Duplex
Uncode or Binary Messages
TCP Protocol
34. GOOD REST APIs
Are consciously designed
Version at the right scope
Don’t leak implementation details
Use auth models relevant to consumer
Are well documented with examples
35. What now?
➡join api-craft
➡read The REST API Design Handbook
➡read Building Hypermedia APIs...
➡socialize your ideas
Thank you!
Editor's Notes
\n
we need to define what we are talking about, and then evaluate patterns\n
\n
\n
Now that we are here, we underscore motivations to even bother with.\n
A Web API Study: Hurwitz;\n leads to integration -> stronger ecosystem -> more value\n > devices and applications in the ecosystem\n\n
At first glance, we might think how to present an api is rest vs soap\n
it might really be the aspects of WS-* that would make such a decision, such as WS-Security, AtomicTransaction, ReliableMessaging\n
Say we chose, ReST.. the thing is that ReST means a lot to many people\n
ends up being something between soap and hypertext driven\n
Leonard Richardson circa 2008 Maturity Model\n
Easiest example of POX is tunneling commands over a single http request/response paradigm\n
many uris, but a single invocation method. operations might be encoded in parameters, and resource might be mixed in with them\n
HEAD is metadata; PATCH is for update; PUT is replace; POST -> RPC/create\natomicity underpins idempotence; by spec POST can affect multiple resources, but most others (except notably trace,options) only apply to the resource identified by the href\n
\n
\n
HATEOAS is basically a state machine. Your responsibility is to not attempt any transition undefined in links\n
New resources types can be added without breaking client, as can new fields/links\nabove pattern recommended by: Dan Feist\n\nOther option you can use is link with profile relation.\n
There are other ways, too...\nxlink can decorate in namespace of xml, but doesn&#x2019;t expose representations\ncollection+json is an interesting approach for managing collections (includes its own data format)\n
define domain-specific type using type link parameter, or via custom rel or profile link (preferred)\nhttp://tools.ietf.org/id/draft-kelly-json-hal\nalso supports templated urls such as queries\n
\n
sometimes domain models are well defined, so the added value may be lost on the user\n
Leonard Richardson circa 2008 Maturity Model\n
Prickles & Goo: Alan Watts Trey Parker Matt Stone\nIs culture behind adoption of a particular rest approach? Even if the approach is correct, can you persuade devs to adopt something they don&#x2019;t want?\n
we are probably at various intervals on the same plane. more detail == overly complex. not enough == naive.\n
Amundsen, Mike (2011-11-22). Building Hypermedia APIs with HTML5 and Node (p. 20). OReilly Media - A. Kindle Edition. \n
database details such as pagination, etc\n\ntransition to a design that isn&#x2019;t rest (aws)\n
original has been around since 2008, latest update mainly addressed oauth and rate limiting changes; thanks Greg Campbell for insight; api is versioned as 1.1, but includes 3 distinct apis\naside: search can be modeled in HATEOAS, where POST is creation of search results, HEAD returns lifespan, etc\n\n
Many amazon web services do not even follow type 2 classifications, yet they are widely adopted, and successful.. why is that? why do they not use rest?\n\ngurupa is the amazon http server, which is tuned for query parsing. language for extending it is simple (add a key), so parsing it to verify signature is just sort the keys and sign it.\n\nbulk ops like s3 multi-delete help deal with very large problems.\n
Ex. ELB you have to use TCP/SSL as this is not a HTTP compatible protocol\nconsider impact for example lack of origin IP address, sticky session\nnew set of gateway products will emerge to support WebSockets\n