APIs and MicroServices Flashcards
What is an API?
Application Programming Interface (API) is a way for one application to connect to another application.
It is a request-response setup where API takes client’s requests to an external system/application and returns the response back from system/application.
Give an example of API.
When we book a flight ticket from the website of the flight company itself, the ticket booking application can directly check the database of bookings and provide a seat.
If we are booking a flight from a third party website which provides us a comparison of prices between different flight companies, the third party client cannot directly connect to the databases of each company. It instead connects to the APIs of those applications, which take the request parameters and lookup their databases. The response provided by APIs is received by the third party client and displayed on screen.
What are the advantages of APIs?
- As a client, we have to only “consume” an API, i.e., just send request to it and receive responses from it. We do not have to program it.
- APIs are platform independent because even if the client and the API itself are written in two different languages, they communicate with each other via common language such as XML/JSON.
- APIs are upgrade safe.
What is a web service?
An API which requires exposure to a network is called web service. An API can also be a simple API which needs no network and only communicates with another application on the same interface without network.
This makes all web services APIs but the vice versa may not be true.
To send data over the internet, it must be in correct format, which could be XML/JSON and must use correct protocol, which could be SOAP/REST.
What is XML?
Extensible Markup Language (XML) is a type of data sent to/received frommostly SOAP APIs. XML uses tags similar to HTML except that for XML, the tags are extensible, i.e., can be customized.
What is JSON?
JavaScript Object Notation (JSON) is a type of data sent to/received from mostly REST APIs. JSON uses key value pair
in the format “key”:”value”.
What is SOAP?
Simple Object Access Protocol (SOAP) is a web service protocol that defines the structure of HTTP request/response to connect to a web service. The SOAP request body must use XML for communication.
It must use Web Services Description Language (WSDL) which describes the web service endpoints in XML format. A SOAP request must follow WSDL.
Every SOAP API uses POST method, not because it creates a new resource, but it is used as a mere placeholder as SOAP needs no HTTP method.
What is REST?
REpresentational State Transfer (REST) is an architecture in which server transfers XML/JSON representation of the current state of the resource to the client.
The web services which adhere to this REST style, called RESTful web services, are stateless, meaning no client context is stored on the server.
Unlike SOAP, REST uses HTTP methods.
What are the few common web security principles?
Authentication- is about validating the identity of client.
Authorization- is about determining the level of client’s access.
Basic Auth- requires username and password which is encoded and sent via the header of HTTP request. If the credentials are correct then the response is sent otherwise 401 Unauthorized Request status is sent.
API Key Authentication- requires APIs to be accessed with a unique key
What is the difference between APIs and Web Services?
APIs and Web Services both facilitate the communication between two applications/services.
Web Services must use network for this communication to take place whereas APIs can work without network.
APIs are lightweight structures whereas Web Services have the overhead of packing and unpacking of data as they use SOAP protocol which is not lightweight.
All Web Services are eventually APIs but not all APIs are Web Services.
What are the two types of web services?
SOAP and RESTful
Why are RESTful APIs better than SOAP APIs?
SOAP is a communication protocol whereas REST is an architecture style.
RESTful APIs promote loose coupling and allow for greater variety of data formats such as XML, JSON or anything entirely new. This adds a lot of flexibility.
SOAP APIs must use XML, which contains data in essentially string format and needs a layer of metadata on top to describe the data. This makes it heavy.
With REST, We can provide various types of HTTP responses to client but with SOAP, its either 200 OK or 500 Server Error.
What is HATEOAS?
Hypermedia As The Engine Of Application State (HATEOAS) means that a client interacts with the REST API entirely through the responses sent dynamically by the server.
Put even simply, it means that client shouldn’t need any documentation/ out-of-band information to use a REST API.
This might be odd as working with a new API requires going through its documentation to see what endpoints are provided by the API, how requests should be structured and what responses should be expected.
With RESTful APIs, the resources should be discoverable through publication of links.
For e.g. in a banking application, when client clicks a link to view the account balance, the response should also provide links to deposit money, transfer money or close account, without the client having to see documentation.
If the account balance is low, then the links should not contains ways to close account but only to deposit money.
This says that as per requests, the server should dynamically send back new ways of interaction.
Explain OAuth.
The Open Authorization (OAuth) framework enables a third-party application to obtain limited access to a web service.
In traditional client-server authentication model, the client requests a protected resource on a server by providing its credentials. In order to provide third party applications access to such protected resources, the resource owner had to share the credentials with third party, creating security issues.
OAuth addresses these issues by introducing a layer of authorization. Instead of using the resource owner’s credentials to access protected resources, the client obtains an access token, issued by an authorization server.
Explain the OAuth protocol flow.
- The client first sends out the Authorization Request to resource owner.
- The request is accepted and resource owner sends Authorization Grant to the client which is the representation of resource owner’s authorization.
- The client requests an access token by sending the Authorization Grant to authorization server.
- Authorization server authenticates the client and validates authorization grant, and if valid, issues Access Token.
- The client requests protected resources from resource server and authenticates by providing access token.
- The resource server validates access token and if valid, serves the request.
