Service oriented systems have become hugely popular, and the golden age of the monolith has past. Sometimes these services can be fantastic, and other times not so much. Learning how to evaluate APIs and identify problem areas before jumping head first into development can save teams frustration, time, and money. This session will walk through evaluating an API, best practices, and red flags, all from the standpoint of a developer consuming them. No matter your experience level, you'll leave with the skills to effectively tackle your next API. This version given at 200ok May 2019

1. APIs: The Good,
The Bad, The Ugly
Michele Titolo
Software Engineer, Square

2. @micheletitolo
Consulting
Mobile
Backend

3. @micheletitolo
What Do API
Consumers Care About?

4. @micheletitolo
• Documentation
• URLs
• Payloads
• Authentication
• Authorization
• Errors
• Caching
They Care About…

5. Documentation

6. @micheletitolo
The Good

7. @micheletitolo
It Exists

8. @micheletitolo
Bonus: It’s Interactive

9. @micheletitolo
Open Api Specification

10. @micheletitolo
ReDoc https://rebilly.github.io/ReDoc/

11. @micheletitolo
The Bad

12. @micheletitolo
Docs Aren’t Updated

13. @micheletitolo
The Ugly

14. @micheletitolo
Documentation?

16. Urls

17. @micheletitolo
The Good

18. @micheletitolo
Consistency

19. /users/22445
/products/3156
/movies/127/times

20. @micheletitolo
REST Conventions

21. @micheletitolo
The Bad

22. @micheletitolo
Inconsistency

23. /users/22445
/reviews/3156
/times/127
Not review or time id’s

24. @micheletitolo
The Ugly

25. @micheletitolo
“GET /remove to delete”

27. Payloads

28. @micheletitolo
The Good

30. @micheletitolo
Respect Content-Type

31. @micheletitolo
Versioning

32. @micheletitolo
The Bad

33. Endpoint “id” field
/products id
/products/:id productID
/cart product_id

34. @micheletitolo
Change

35. @micheletitolo
We Expect Certain Things

36. @micheletitolo
...like image urls having
http://

37. @micheletitolo
...Like Dates Sent In The
Same Format

38. @micheletitolo
We Expect Certain Things
To Not Change

39. @micheletitolo
The Ugly

40. @micheletitolo
Json Containing Html

43. @micheletitolo
Unstable

45. Authentication

46. @micheletitolo
The Good

47. @micheletitolo
SSL

48. @micheletitolo
...when SSL is secure

49. goto fail;

50. @micheletitolo
SSL Pinning

51. @micheletitolo
OAuth

52. @micheletitolo
The Bad

53. @micheletitolo
OAuth

55. @micheletitolo
The Ugly

57. Authorization

58. @micheletitolo
The Good

59. @micheletitolo
App Requests Permissions

61. @micheletitolo
The Bad

62. @micheletitolo
A Single Api Key

63. @micheletitolo
{"message":"API rate limit exceeded"}

64. @micheletitolo
The Ugly

65. @micheletitolo
Authorization?

68. Errors

69. @micheletitolo
The Good

70. @micheletitolo
Error Codes

71. @micheletitolo
Error Message In
Response

72. @micheletitolo
Human Readable Error
Message

73. @micheletitolo
The Bad

74. @micheletitolo
“There Was An Error”

76. @micheletitolo
The Ugly

80. Caching

81. @micheletitolo
The Good

82. @micheletitolo
Using One Of The
Standards

83. @micheletitolo
Cache-Control

84. @micheletitolo
If-Modified-Since

85. @micheletitolo
Etags

86. @micheletitolo
The Bad

87. @micheletitolo
Manually Processing Data

88. @micheletitolo
The Ugly

89. @micheletitolo
Caching

92. In Summary

93. @micheletitolo
Consistency

94. @micheletitolo
Conventions

95. @micheletitolo
Simple

96. Questions?
@MicheleTitolo

97. JSONSchema, Open Api Spec, RAML
Charles, Postman
http://runscope.com, also http://newrelic.com for backend analytics
Versioning: http://apiux.com/2013/05/14/api-versioning/
Resources

98. • https://unsplash.com/photos/slItfWbhijc
• https://unsplash.com/photos/D6uxeDSylxo
• https://unsplash.com/photos/fbDPzqOXwuY
• https://unsplash.com/photos/8yYAaguVDgY
• https://unsplash.com/photos/yVXUtrNzJBM
• https://unsplash.com/photos/BFRdqVAMAhU
• https://unsplash.com/photos/1eWaod96d3k
• https://unsplash.com/photos/IUY_3DvM__w