REST APIs and HTTP

Name: REST APIs and HTTP
Author: Josh Guardino

Learn the details of the HTTP protocol as related to REST APIs

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

Hello, my name is Josh Guardino, and in these lessons you will learn about REST APIs and HTTP. Let's begin by gaining a basic understanding of the HTTP protocol. The HTTP protocol involves the transfer of documents over the internet. These documents may take the form of webpages, JSON, XML, images, videos or anything else that can be sent over the internet. It is a client-server paradigm in which a server sends resources in the form of responses to a client. The client could be a web browser, an API client written in code, or a tool such as Postman. A client is any piece of software that is issuing a request to a server. This would include web APIs and many other types of content. HTTP requests consist of three basic elements of metadata in addition to the HTTP protocol designation, the request method or verb, such as get, post, put, delete, the path, which is the specific resource that the request is trying to reach, in this case here a slash would be the root path, and then the headers, which are key value pairs containing important information about the request itself. Headers are not restricted to requests. Responses also send headers back with the results. HTTP is a stateless protocol. This means that each request to the server is considered a standalone request, and the server does not attempt to associate one request with another request as some types of remoting protocols do in order to allow clients to send multiple messages as part of a larger transaction. The stateless nature of HTTP necessitates the sending of full meta information such as headers each time a request is sent, although there are some mechanisms, such as cookies, that the server can pass back to the client to be sent back to the server in subsequent requests that do provide some contextual information, but this does not change the fact that the protocol is always stateless. HTTP is closely associated with TCP, which is the protocol that governs the transmission of data. TCP is responsible for breaking up data into packets and reassembling them in the correct sequence when received by a server. In my list of collections, I have a category labeled DummyJSON. These DummyJSON services are hosted by dummyjson.com which provides these API endpoints for testing purposes. Unlike the Department of Motor Vehicles API that I'm running locally on my computer, this is a true web-based API. And let's analyze the products path, hosted by dummyjson, using the get method. The URL is https:// then the hostname, and then the path, which in this case would be /products. Contrast this with my local Department of Motor Vehicles API, which has a host name beginning with HTTP without the S. HTTPS is a secure version of HTTP. Because the plain HTTP protocol is inherently insecure, it is quite easy for malicious hackers to eavesdrop on, intercept and modify HTTP requests without the knowledge of the sender. This is why the HTTPS is critical and you should never trust any internet site that does not have the S in the protocol, because messages transmitted back and forth using HTTPS leverage a very secure mechanism called transport layer security or TLS. This ensures that all HTTP messages are encrypted and may only be read by the client and the server. HTTPS and TLS rely on certificates, regardless of whether the client is a web browser, programmatic code, or a software tool, such as Fiddler or Postman. So let's look at the security information for dummyjson.com. The lock icon in my web browser tells me that the site is secure, and by clicking on it the full details of the secure certificate are shown. Clients that connect to HTTPS services should always validate the certificate because certificates are easy to generate in an insecure manner and they have expiration dates. So it's critical for a client to recognize the issuer of the certificate and confirm that it is still valid. In Postman, in the settings, there is a toggle switch for SSL certificate verification, and it is defaulted to off because normally when you are using Postman, you are testing APIs, and not sending or receiving sensitive information. But enabling SSL certificate verification is a good practice, even in an environment such as this, to ensure that messages are always secure. As you can see, the request to the dummyjson.com server is accompanied by a tunneling request on port 443, which is the standard secure port number, and in the inspector I can see all of the information about the certificate and more. Thanks for watching. Stay tuned for the next lesson where I will show you how to use and read HTTP headers.

Beginner Provider : Josh Guardino 3 Lessons · 20m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

One of REST's strongest benefits is that it is built on the same core principles that power the internet. This involves the HTTP protocol, the standard transport mechanism for virtually all web traffic. HTTP is a sophisticated protocol, but it has several hallmark characteristics that are easy to learn. You will learn about HTTP fundamentals as well as those of HTTPS, the secure form of HTTP.

HTTP headers are critical containers of metadata required to process requests and responses successfully. They cover a wide range of categories and can have a dramatic effect on what is sent and received. These lessons will explore the most common headers and their relevant and applicable uses.

Also critical for the operation of any HTTP communication is the concept of status codes. Responses always are accompanied by a status code that is numbered according to a standard list of conditions, and using status codes allows REST clients to quickly and accurately determine the nature of the response and dictate any actions that must be taken.

What You'll Learn

Describe the HTTP protocol and how it supports REST APIs
Explain the fundamentals of HTTPS, the secure form of HTTP
Identify the most common types of HTTP headers and describe their significance
Recognize how HTTP headers affect what is sent and received in requests and responses
List the most common types of HTTP status codes and explain their numbering system
Use status codes to determine the nature of a response and any required actions

Key Takeaways

REST is built on the same core principles that power the internet, including the HTTP protocol used as the standard transport mechanism for virtually all web traffic.
HTTPS is the secure form of HTTP.
HTTP headers are critical containers of metadata required to process requests and responses successfully, and they can have a dramatic effect on what is sent and received.
Responses are always accompanied by a status code numbered according to a standard list of conditions.
Using status codes allows REST clients to quickly and accurately determine the nature of a response and dictate any actions that must be taken.

Frequently Asked Questions

What does this course cover?

The course covers HTTP fundamentals and HTTPS (the secure form of HTTP), HTTP headers and their uses, and HTTP status codes and how their numbering system categorizes responses. Lessons include HTTP, HTTP Headers, and HTTP Status Codes.

What will I be able to do after taking this course?

You will be able to describe the HTTP protocol and how it supports REST APIs, list the most common types of HTTP headers and describe their significance, and list the most common types of HTTP status codes and explain how the numbering system helps categorize them.

Why is HTTP important for REST APIs?

One of REST's strongest benefits is that it is built on the same core principles that power the internet, including the HTTP protocol, the standard transport mechanism for virtually all web traffic.

What skills does this course help build?

The course is associated with skills in API Design, HTTP Headers, HTTP Protocols, REST API Development, REST Client, and RESTful API.

Why are HTTP status codes useful?

Responses always include a status code numbered according to a standard list of conditions, which allows REST clients to quickly and accurately determine the nature of the response and dictate any actions that must be taken.