js api diff methods and way to write it

63 topics across 6 chapters

Chapter 1

HTTP & REST fundamentals (what APIs are doing under the hood)

URL anatomy: paths, query parameters, encoding

Headers & content types (Accept, Content-Type, Authorization)

HTTP methods (what they mean + when to use)

5 subtopics

GET: read data, query params, idempotent & safe semantics

POST: create actions/resources, request body, 201 + Location header

PUT vs PATCH: full replace vs partial update; idempotency differences

DELETE: deleting resources, 204 responses, soft-delete patterns

OPTIONS: capabilities + CORS preflight (why it happens)

Status codes + caching basics (200/201/204, 400/401/403/404/409, 500; Cache-Control, ETag)

Chapter 2

JavaScript: making API requests (browser/client)

Async/await & Promises for API calls (chaining, parallel, race)

Sending data formats: JSON, FormData, URLSearchParams, multipart

Using fetch() (modern standard)

4 subtopics

fetch GET example: query params, headers, parsing JSON

fetch POST JSON example: body, Content-Type, handling 201/400

AbortController: cancel requests + implement timeouts with fetch

Uploads/downloads with fetch: blobs/streams; progress limitations & workarounds

Using Axios (popular library)

4 subtopics

Axios GET/POST patterns: params, data, headers, baseURL

Axios interceptors: auth header injection, refresh-token flows, global error handling

Canceling Axios requests (AbortController/cancel patterns)

Files with Axios: multipart/form-data uploads + blob downloads

XMLHttpRequest (legacy) and when you still see it

CORS & browser security model (same-origin, credentials, preflight)

Chapter 3

Handling responses, errors, and common API patterns

Parsing responses (JSON/text/blob/stream) and response shapes

3 subtopics

response.json() pitfalls: empty bodies, 204, invalid JSON, big payloads

Non-JSON responses: text(), blob(), arrayBuffer() and content-type checks

Large responses: streaming basics and memory considerations

↗ Status codes + caching basics (200/201/204, 400/401/403/404/409, 500; Cache-Control, ETag) (see Chapter 1)

Error handling patterns: network errors vs HTTP errors; normalize error objects

Retries/backoff + rate limits: 429 handling, jitter, circuit breakers (basics)

Common API patterns: pagination, filtering, sorting, cursor vs offset

Chapter 4

Authentication & security for APIs (client-side perspective)

API keys & Basic auth: how to send them; why not to expose secrets in frontend

Bearer tokens & JWT basics: headers, expiry, refresh vs re-login

OAuth 2.0 + PKCE (SPA/mobile-friendly flow) at a high level

Token storage choices: HttpOnly cookies vs localStorage; trade-offs

CSRF, SameSite cookies, and when CSRF protection is needed

↗ CORS & browser security model (same-origin, credentials, preflight) (see Chapter 2)

Chapter 5

Building APIs with Node.js (server-side)

Express/Fastify setup & project structure

3 subtopics

Initialize server project: npm, TypeScript optional, folder layout

Create a health endpoint + run locally (port, basic handler)

Environment configuration: dotenv, config separation, secrets handling

Routing & controllers (designing endpoints)

3 subtopics

RESTful route design: nouns, nesting, avoiding action verbs in URLs

Request parsing: JSON bodies, multipart, limits, and size validation

Consistent responses: envelope vs raw, error shape, setting status codes

Implement CRUD endpoints mapping to HTTP methods + consistent status codes

Validation & schemas for request/response

2 subtopics

Validation with Zod/Joi/etc.: schemas for params/body/query

Validation errors: return 400 with useful messages (don’t leak internals)

Middleware essentials: auth, logging, error middleware, request IDs

Database integration basics: connection, queries, avoiding SQL injection (high level)

API documentation: OpenAPI/Swagger, examples, keeping docs in sync

Chapter 6

Testing, debugging, and best practices

Testing server APIs: integration tests with supertest (or similar)

Testing API clients: mocking with MSW (or similar)

Mocking & stubbing: fake timers, deterministic tests, fixtures

Debugging: DevTools Network tab, server logs, correlation IDs

Performance & security checklist: input limits, authz checks, rate limiting, HTTPS

API versioning & backwards compatibility: /v1, headers, deprecation strategy

↗ API documentation: OpenAPI/Swagger, examples, keeping docs in sync (see Chapter 5)