Browsing Category
DevSecOps
116 posts
Web Application Firewalls for APIs: A Complete Guide to WAF Protection
I remember the first time an API I was responsible for got hit with an automated scanning attack…
Receiving Authorization in APIs: OAuth, API Keys, and Token-Based Access Explained
One of the most confusing parts of working with APIs, especially for people just getting started, is figuring…
How to Describe API Goals with the OpenAPI Specification (OAS): A Complete Beginner-to-Advanced Guide
When I sit down to build a new API, the first thing I do isn’t write code. It’s…
How to Describe Data with JSON Schema and OAS: The Definitive Guide to Precise API Data Modeling
Once I’ve mapped out an API’s goals with OpenAPI, the very next thing I focus on is data.…
How to Reuse Components in an OAS Document: Building Maintainable, DRY OpenAPI Specifications
The first time I wrote a large OpenAPI document without thinking about reuse, I ended up with the…
How to Describe API Security with OpenAPI (OAS): A Practical Guide to Authentication and Authorization in Your Spec
Security is one part of API design I refuse to treat as an afterthought, and I refuse to…
Designing a Secure API: A Complete Practical Guide Beyond Just Authentication
Documenting security in OpenAPI, which I covered in the previous article, tells consumers how to authenticate. But real…
Designing a Network-Efficient API: How to Reduce Latency, Bandwidth, and Round Trips
Every request your API handles travels across a network, and networks are never as fast or as reliable…
Focusing on the Consumer’s Perspective to Create Simple APIs: A Practical Guide to Developer-Friendly API Design
Of everything I’ve written in this series — goals, data, reuse, security, network efficiency — none of it…
How to Choose the Right HTTP Status Codes for Your API: A Complete Reference Guide
Status codes are one of the most underrated parts of API design. I have seen APIs that return…