RESTful services Flashcards
1
Q
What does REST stand for?
A
REpresentational State Transfer
2
Q
HTTP is considered stateless because…?
A
The request before or after this current request are executed independently and have no knowledge of each other.
3
Q
A GET command in a GET request is immediately followed by the…
A
resource location
4
Q
The ? character in a GET request indicates…
A
the beginning of the parameters
5
Q
Parameters in a GET request are seperated by…
A
The & character
6
Q
What is the code for an ‘ok’ response for a HTTP request?
A
200 OK
7
Q
What is REST?
A
REST is a software architecture that can be followed while designing systems.
8
Q
With REST, you should provide every resource with what?
A
A unique ID (for example a URI).
9
Q
Within REST architecture, you should link what together?
A
Resources, establishing relationships between the resources
10
Q
What kind of methods should be used when implementing REST?
A
Standard methods - such as HTTP / XML
11
Q
Resources can have multiple representations - what does this indicate?
A
Different application states
12
Q
The communication in REST should use HTTP, what does this imply?
A
That it should be stateless
13
Q
What approach is used to separate user interface from data storage?
A
Client / Server
14
Q
The client / server interaction is…
A
Stateless
15
Q
Servers host what?
A
Resources
16
Q
Clients consume what?
A
Resources
17
Q
Any information that can be named, can be a…
A
Resource
18
Q
A resource has what associated with it?
A
A URI (identifier)
19
Q
Any given resource can also have associated what?
A
Metadata
Such as media-type, last modified time etc
20
Q
When accessing a resource, the resource identifier along with what is specified?
A
The action to be performed on the resource
21
Q
Actions are defined using HTTP what?
A
Verbs
22
Q
What does the GET verb do?
A
Retrieves a resource identified by a URI
23
Q
What does the POST verb do?
A
Sends a resource to the server, updates the resource in the location identified by the URI
(Post can be used to update the resource)
24
Q
What does the PUT verb do?
A
Sends a resource to the server, to be stored in the location identified by the URI - if the resource already exists, it is modified
(Creates the resource, starts the lifecycle)
25
What does the DELETE verb do?
Deletes a resource identified by a URI
| Ends the life cycle of the resource
26
What does the HEAD verb do?
Retrieves the metadata of a resource identified by the URI
27
What PHP function is most suited to sending / retrieving data via http?
curl
28
How do you init curl?
$client = curl_init($url);
29
How do you terminate a curl connection?
curl_close($client);
30
Does the file_get_contents function work with web redirects?
Yes - it will automatically follow redirects, rather than returning the redirect message itself.
31
What configuration option is required to be on in order to use standard PHP file handling functions to do HTTP requests (such as file_get_contents)?
allow_url_fopen directive must be turned on in the php.ini file
32
What package might be useful if cURL is not available, and allow_url_fopen is not enabled on the webserver?
HTTP_Request2 - which is a PEAR package. PEAR packages are plain PHP, so as long as I can install a PHP file on the sever, it can be used.
33
What function do you use to configure curl when it is initialised?
bool curl_setopt(resource $ch, int $option, mixed $value)
34
What does the option CURLOPT_RETURNTRANSFER do?
When set to true, it tells curl to return the data via the call to curl_exec (i.e. as a string return value)
35
What function would you use to load a url into a xml format via url?
SimpleXMLElement simplexml_load_file();
36
What function can you use to load xml from a string (that has perhaps been obtained via curl)?
SimpleXMLElement simplexml_load_string();
37
What function can you use to build a query string?
string http_build_query();
38
If you are accessing a site that uses http basic auth, how would you modify your file_get_contents call to pass the username and password?
```
$url = "http://caino:supercool@www.example.com";
$file = file_get_contents($url);
```
39
If you are using basic auth - what curl_options would allow you to pass the password and username to retrieve data?
curl_setopt($c, CURLOPT_USERPWD, 'caino:superhaxor');
(Same can be done by using CURLOPT_HTTPHEADER option and using a base64 encoded string to write the header with password and username in it).
40
How do you configure file_get_contents to not follow redirects?
```
$options = array('max_redirects' => 1);
$context = stream_context_create(array('http' => $options));
$file = file_get_contents($url, false, $context);
```
41
What function do you use to create a new context?
stream_context_create()
42
What is a stream context?
A set of parameters and wrapper specific options which modify or enhance the behavior of a stream.
43
cURL only follows redirects when?
When CURLOPT_FOLLOWLOCATION is enabled
| curl_setopt($c, CURLOPT_FOLLOWLOCATION, true);
44
How do you configure the maximum number of redirects for cURL?
curl_setopt($c, CURLOPT_FOLLOWLOCATION, true);
| curl_setopt($c, CURLOPT_MAXREDIRS, 4);
45
How would you write a file from the web to a local file using cURL?
$fh = fopen("local-copy-of-html-file.html", "w") or die($php_errormsg);
$c = curl_init("http://example.com/filelocation.html");
curl_setopt($c, CURLOPT_FILE, $fh);
curl_exec($c);
curl_close($c);
46
How could you get cURL to write to a callback function (i.e. for writing to a database)
curl_setopt($c, CURLOPT_WRITEFUNCTION, array($pageSaver, write));
```
// Where $pageSaver is an object, and write is the method
// it will pass on the curl object and the page data
```
47
What is the fundamental unit of REST?
A resource
48
Resources can be identified by two means, what are they?
URI - (Universal Resource Location) - Location
| URN - (Universal Resource Name) - Name
49
Is a URL a URI?
Yes
50
Is a URI a URL?
Not necessarily, although it can be.
51
Why are URN's different from URL?
URN's are intended to be unique in both space and time - they should identify a resource in such a way that there is no ambiguity.
52
Why are URL's different from URI's?
URL's can be URI's, but a URI doesn't necessarily have to be a URL. This is because they have different potential syntax.
53
What is the format of a URN?
urn::
Where nid is the namespace identifier, and nss is the namespace specific string.
Example:
urn:isbn:03432234235
54
What is the standard format for a REST url?
/version/resource/key
55
Can you process a REST request from the following URL?
www.cainmartin.net/v1/chickens/20
No - we don't know what the HTTP method is, therefore we cannot process the request.
56
Some methods in a REST API must be safe, what is a safe method?
It doesn't modify the resource (GET is a good example)
57
Some methods in a REST API must be idempotent, what is an idempotent method?
Calling an idempotent method many times is equivalent to calling it once.
58
What are the NON-SAFE methods?
POST, DELETE and PUT
59
What are the idempotent methods?
GET, PUT, DELETE
60
Which method is neither considered safe, or idempotent?
POST
61
What HTTP feature is used to indicate status of a request?
HTTP status codes
62
Which status codes are considered to be success?
The 200's.
63
Which status codes are considered to be client errors?
The 400's
64
Which status codes indicate further action is required for the server to respond?
The 300's
65
What status codes indicate a server error?
The 500's
66
Is it okay for a resource to have different representations?
Yes - this is quite normal, i.e. it could be JSON, or XML, or HTML and PDF
67
What $_SERVER variable is useful for determining where to route a REST request?
$_SERVER['REQUEST_METHOD']
68
If a client attempts to use a method which is not allowed, which HTTP response should you reply with?
405 - Method not allowed
69
Do the following urls' point to different resources?
http: //www.food.com/stuff/brocolli
http: //www.food.com/stuff/Brocolli
Yes - they point to different resources. Technically URL's are case sensitive. (But most web servers will try to make the server behave like they are case insensitive, so in all likelihood will arrive at the same resource).
70
HTTP is a request and ..... protocol.
Response
71
The request and response are handled in a .... HTTP transaction
single
72
Because some methods are not safe, how do we deal with users being left on a page after a non-safe method, refreshing their browser?
One method is to do a redirect after successfully completing a post / or delete (or whatever safe method). This will redirect to a GET page. The GET may simply retrieve the result of the last unsafe command (i.e. a list of users, or confirmation number)
73
There is a name given to the practice of redirecting after a post - what is it called?
POST / REDIRECT / GET or PRG.
74
With a safe method (i.e. GET), there is a benefit to having the query string visible in the URL, what is it?
Users can bookmark the url with the query string embeded within it (which could be a search, or whatever). Because GET is both safe and idempotent, there is no issue with the user refreshing the page.
75
A full HTTP request message consists of what parts?
[method][url][http version]
[headers]
[body]
76
What is the most common HTTP version seen in request headers as of today?
1.1 (with 2.0 on the horizon)
77
What is the only required header in HTTP 1.1?
host
78
What header could be used to indicate it wants to accept the response in french?
Accept-Language: fr-FR
79
When a header does appear it must...
obey the standards for that header
80
What does the Referer header do?
When a user clicks a link - the client can send a link to the referring page in this header
81
What does the User-Agent header do?
Contains information about the user agent / software making the request. Can often be used to determine which browser is making the request.
82
What does the Accept header do?
Describes the media types the user-agent is willing to accept, used for content negotiation.
83
What does the Cookie header do?
Contains cookie information
84
What does the If-Modified-Since header do?
Will contain a date of when the user-agent last retrieved (and cached) the resource. The server only has to return the entire resource if it has been modified since that time.
85
Some headers can contain multiple values, how are they separated?
By commas usually
i.e.
Accept-Encoding: gzip,deflate,sdhc
86
If you see */* in an Accept header, what does this indicate?
That the client will ultimately accept any data - and will determine itself how to deal with it.
87
What parts / components does a http response contain?
[version][status][reason]
[headers]
[body]
88
Which status codes are considered to be informational?
The 0-100's.
89
Which redirect is usually used after a successful POST request to make the client retrieve data using GET? (i.e. after a user successfully logs into a system).
302 - Moved temporarily. The client should continue to use the original URL to obtain the resource
90
If the server has encountered an error in the syntax of the request, what should it respond with?
400 (bad request)
91
If a user attempts to access a resource they don't have permission for, what response should be returned?
403 (forbidden)
92
If a server is throttling requests due to heavy load - what response should be used to indicate this?
503 (Service Unavailable)
93
If a user sends a request to create a new user, but forgets to fill in a field, what response should the client receive?
200 OK.
The HTTP response and the clients requirements may be different. The HTTP connection occurred and completed successfully, so it should return 200. However, the response will contain information within it that indicates there was an error. NOTE: This is generally the case for web applications and not for web API's and web Services.
94
Web API's and Web services generally operate closer to...
the HTTP spec than web applications. This is evidenced in how they use HTTP codes - rather than returning 200 OK for a failed attempt to create a user, a web service/api may return 400 (bad request) with information in the body as to what went wrong. This is because the web service is likely returning XML / JSON not intended for direct human interpretation.
95
A server may include in the response the content type which is known as a ....
a MIME type
96
What is an ETag (in a response header)?
A header which is related to caching / performance optimization. It is an identifier that will change when the underlying resource changes. Therefore comparing ETags is an efficient way of determining when a cached resource has become stale.
97
What does the 'Connection: close' header indicate?
That the connection to the server may not be persistent. Typical with inexpensive hosts like goDaddy.
98
A forward proxy is closer to...
the client - and the client may require some configuration to use it.
99
A reverse client is closer to...
the host - and is invisible to the client.
100
In HTTP 1.1, can a response with a 200 OK header be cached?
Yes
101
What headers control how caching may be done?
Cache-control
| Expires (although this is deprecated, still used)
102
What are the possible values of Cache-control header?
public - public proxy can cache it
private - only users browser can cache it
no-cache - no one can cache it
no-store - no caching, and also should store the data as it has sensitive information
max-age - gives a time to expire
103
With HTTP, what are some options with storing state, given HTTP is a stateless protocol?
You can store state in hidden fields to be sent with the next request - good for short lived state tracking, like form filling progress.
You can store state on the server - PHP sessions.
104
What is the 'fat url' technique of tracking a user?
When cookies are not available, the server may write an identifier into the url (cookieless session essentially).
105
What does the HttpOnly flag do (as part of the set-cookie header)
Prevents JavaScript from modifying cookie data - useful to prevent XSS attacks.
106
Why do cookies potentially interfere with caching?
Because cookies can be used to identify users, there could be security risks related to caching a cookie - therefore they should not be cached. So any response with a Set-Cookie header should not be cached (at the very least, not the headers).
107
In HTTPS what is encrypted?
Everything after the host name in the url, and all request and response traffic (including headers and body).
108
When we send a request to a server, the server usually responds with a document, this document is called a...
representation of the resource
109
The concept of addressability says that every resource should have...
it's own url
110
In REST terms, the page that you are on represents the...
application state
111
What is HATEOAS?
Acronym for - Hypermedia As The Engine Of Application State
| Basically refers to 'which page you are on'
112
The value of the content-type header is known as the ........ of the body.
media type (or MIME type)
113
JSON must be served as... (what content-type)?
application/json
114
If you receive a content type of "application/vnd.collection+json", is it just JSON?
No - JSON is served using "application/json" - this indicates that it's a collection+json, which is a standard for publishing searchable list of resources over the web.
115
If you have a content type collection+json, what formatting is required?
It must be a JSON object, and have an element called 'collection'.
{ "collection": { "items": [{}, {}, {}]}}
The items within the item field must also be objects.
116
The collection+json standard requires a href field - what does that href point to?
The address used to retrieve a representation of the document.
117
What element of a collection+json document instructs the client as to how to build a message?
The template section
118
In REST, a representation should describe...
A resources state
119
What are two methods by which an API can provide multiple representations of the same content (i.e. a JSON format and an XML format)?
Client negotiation - i.e. the client uses the HTTP headers to distinguish amongst representations.
The second is to give the resource multiple urls, one for each representation.
120
If I send a http DELETE request, and I receive a 204 - no content reply, what does this mean?
The object was deleted, and the server has nothing more to say about it.
121
If I send a http DELETE request and I receive a 200 OK reply, what does this mean?
The object was deleted, but the server wants to give you further information about it.
122
If I send a HTTP DELETE request and I receive a 202 ACCEPTED reply, what could that mean?
The server has accepted the request for delete - but it will do it later.
123
If the client tries to delete something using a DELETE request, but recieves a 404 NOT FOUND, or 410 GONE code, what does this mean?
It could not delete the object because it doesn't exist. This is an error.
124
What are the two jobs that post has?
Post to append - i.e. sending a request to a resource creates a new resource under it
Overloaded post (where post is used for things other than it's intended purpose)
125
What are the best response codes for a PATCH request?
The same as PUT and DELETE - 200 ok, 204 (no content) is fine.
126
What does the OPTIONS verb do?
It requests a list of http methods the API supports from the server, it contains the "allow" header - which contains the list of options.
127
What is the difference between a GET request and HEAD request?
HEAD request is only supposed to have the headers returned, without the body.
128
Why can't you trigger a DELETE or PUT request from the web browser?
HTML specs only allow get and post actions in a HTML form.
129
If you post a GET request, is the data from any forms in the body?
No - it's encoded in the URL.
130
What kind of request does a HTML [a] tag describe?
A GET request
131
What kind of request does a [img] HTML tag describe?
A GET request for one specific URL, which happens automatically in the background.
132
What kind of request does a HTML [form] tag with a post method describe?
A POST request to one specific URL, with a custom entity body constructed by the client. The request is only made if the user triggers the control.
133
What kindo f request does a HTML [form] tag with a GET method describe?
A GET request to a custom URL constructed by the client. The request is only made if the user triggers the control.
134
How does the Fielding dissertation describe Hypermedia?
Hypermedia is defined by the presence of application control behaviour...
embedded within, or as a layer above, the presentation information.
135
URI templates are defined in what RFC?
RFC 6570
136
What is the difference between a URL and a URI?
All URL's are URI's, but all URI's are not necessarily URL's. For instance - a books ISBN is a URI - and would not make a very good URL as there is no associated protocol that would allow a computer to find it.
137
You can't get a representation without a...
URL
138
What is a link header?
It is a HTTP header field that can be used to provide a URL to another resource. For instance, you could use it to provide the link to the next part of a multi-part document.
139
Which HTTP methods make use of the link header?
LINK / UNLINK
140
What are the four parts of a HTTP request?
The method
The target URL
The HTTP headers
The entity body
141
HTML spec says that a html 'a' tag becomes what kind of request when clicked?
GET
142
Why doesn't a URI template make sense on it's own?
Because it doesn't define the HTTP method to be used - it requires additional information.
143
What does the Content-Type header look like for a form when sent via HTTP POST?
application/x-www-form-urlencoded
144
How could you change the behavior of a form, so that it is not URL ENCODED?
Use the enctype field on the form. i.e.
enctype="text/plain"
145
What kind of 'promise' does the HTML img tag make in regards to the response?
The resulting GET request will result in an image being returned.
146
If you saw 'rel="edit"' in a HTML link tag - what does that say about the resource?
It supports not only GET, but PUT and DELETE. i.e. editing of the resource.
147
What kind of link is an "a" tag in HTML?
An outbound link - i.e. usually takes you off page. When activated, it usually replaces the current state with a new state.
148
What kind of link is an "img" tag in HTML?
Embedded link. These kind of links do not change the clients application state, they augment it.
149
The process of embedding one page in another page is called...
transclusion
150
Name three other embedding links (other than img)?
frameset
script
link
151
Why shouldn't you use plain JSON to represent API's?
Because it does not support hypermedia - you should always use a media type that supports hypermedia
152
What is a link relation in the context of an API?
It is a string associated with a hypermedia control (like an xml tag named 'link') - it explains the change in application state (for safe requests) or resource state (for unsafe requests) that will happen if the client triggers the control.
153
What body tracks the most useful link relations that can be used in REST applications?
IANA - Internet Assigned Numbers Authority
154
Where are link relations registered (to avoid confusion)?
Generally in a media type.
155
What are the two types of link relations?
Registered relation types, extension relation types.
156
Registered relation types look like short strings (i.e. prev, next) - but extension relation types look like...
URL's.
157
How would you define an extension relation?
You can use your domain - i.e. http://www.cainmartin.net/whatever
- this could never have a conflict with someone elses extension, since you own the domain.
158
If a user visited the URL of an extension relation, what should they see?
A human readable explanation of the extension.
159
Can your link relations have the same names as those in the IANA registry?
No - they should not conflict.
160
What are the two steps in bridging the semantic gap when designing a domain specific API?
Write down the application semantics in a human readable specification
Register one or more IANA media types for the design.
161
How does a client developer determine how to utilise your domain specific API?
They can search the IANA for a media type in the registry.
They can read the human readable specification.
162
A collection is a resource that lists other resources by...
linking to them
163
An individual resource within a collection is sometimes called a...
item or entry, or member of the collection
164
In a collection+JSON file, the format contains items, of which each item may contain a link field. Within the link field - is a key/value pair 'render'. If render is set to 'image', what does this mean?
The link should be rendered as an embedded image.
165
In a collection+JSON file, the format contains items, of which each item may contain a link field. Within the link field - is a key/value pair 'render'. If render is set to 'link', what does this mean?
The image should be rendered as an outbound link.
166
In order to write data to an API, (given collection+JSON format) how do you determine the format of the data?
Use the write template which is part of the collection format.
167
How do you add to a collection given the Collection+JSON standard?
The standard says that you can add to the collection by sending a POST request to the collection (i.e. to it's href attribute).
168
Given a very large collection, what is one way a collection+JSON can deal with this, without sending a large set back to the client?
Send a query / search template
169
In Collection+JSON, the search templates for a collection are stored in which slot?
The queries slot
170
What media type represents ATOM publishing?
application/atom+xml
171
If you check an API's media type and get application/json, what does this say about collection resources?
Absolutely nothing - as the JSON standard does not specify anything about collections.
172
If the API is using application/json, what does this say about the api?
It is a new / flat standard, and the only way to determine how it works is to check the documentation.
173
The defining characteristics of a collection is it's behaviour under...
HTTP POST, unless the collection is read only - a client can create a new entry by using POST.
174
What do the collection standards say about HTTP PUT or PATCH?
Nothing, but in general PUT is used to update a resource and this based on the HTTP standard. This is also supported by Collection+JSON, AtomPub, and OData. PUT is how clients change the state of any HTTP resource.
175
What do the collection standards say about HTTP DELETE?
None of the three big collection standards specify how a collection should respond to DELETE. Some applications implement DELETE by deleting the collection, others delete the collection and every resource listed as part of the collection. However, an individual ITEMs response to delete is the same as the HTTP standard - i.e. you delete it.
176
Does collection+JSON have any specific support for pagination?
No - it just assumes you know about prev/next links (which are sent as part of the links)
177
How could you add pagination support to a collection+JSON format?
You could use the IANA generic link relations (next/prev/first/last) - which are registered with IANA, and use them in the links field - with links that match.
178
AtomPub has no support for 'search' - what is the assumption?
That you will plug in your own open standard, such as OpenSearch if required.
179
What is the major difference between an item in Collection+JSON and an AtomPub entry (equivalent of an item)?
An item in Collection+JSON does not have a fixed format, in that it could represent anything - however, AtomPub is designed around news feeds, and so it represents very clearly and quite rigidly a news item.
180
If AtomPub is fairly rigid in terms of it's definition of an item, how is it that Google can use it for almost anything (including representations of cells in a spreadsheet)?
AtomPub is quite extensible, and allows for additional application semantics to be added.
181
Can HTML be used for an API format?
Yes - it works quite well, as it has a very flexible structure, and application semantics can be added to the format via class, rel attributes (among others).
182
What is the problem with making up your own semantics for HTML in an API format?
There is no documentation on what those semantics mean - the user would have to find documentation on them.
183
What is one way to add extra semantics to HTML?
Use a microformat
184
What is a microformat?
A web-based approach to publishing formats that can be used to add extra semantics to existing standards (HTML)
185
What is a common way to utilise an existing recognised data format?
Take an existing format - i.e. vCard, or Maze+HTML and then convert it to html.
186
What is microdata?
Microdata is a refinement of the Microformat idea for HTML5
187
What HTML5 attributes were introduced specifically for the purpose of representing application semantics?
```
itemprop,
itemscope,
itemtype,
itemid,
itemref
```
188
In HTML5, which of the microdata attributes are used like the way a microformat uses the class attribute?
itemprop
189
What does the itemscope attribute indicate?
It is a boolean property that indicates that the tag it is attached too contains microdata.
190
What does the itemtype attribute used for?
It is a microdata attribute that is used to tell the client where to go to find out what the microdata means.
191
Where would the itemtype attribute typically be used?
At the top of the microdata section of the document - usually alongside the itemscope attribute.
```
```
Title
192
What is the one benefit that a microformat has over a microdata?
Microdata cannot define the contents of the rel attribute - it can only define the values of the itemprop elements.
193
What is the issue with using a HTML link as way of changing application state?
HTML links only support GET - but changing application state is not a SAFE action.
194
How would I use HTML to change application state (given that standard hypermedia links represent GET actions which are supposed to be safe actions)?
You can use a FORM - with a POST method.
195
What is the problem with using a HTML FORM element when using Microformats?
The button that triggers a HTML FORM does not support REL attributes - so we have no way of presenting application semantics to indicate what the link is for. (But they do support itemprop and class - so there is a way around this!)
196
What is the difference in thinking of items as resources as opposed to hypermedia when it comes to documenting the design?
When thinking of resources, we would document the API endpoints / urls - as hypermedia we would think about state transitions, i.e. a switch is a resource, in a hypermedia API we would concentrate on what you can do with the switch, not about the switch itself.
197
What limits does HTML4 have when serving an API?
The available hypermedia controls can describe all of HTTPs' methods.
Forms in HTML can only build entity-bodies in two different formats - x-www-form-urlencoded (for basic key/value pairs) or multipart/form-data for key-value pairs plus file uploads).
HTML4 does not distinguish between numbers and strings (unlike json)
HTML4 does not define a way to deal with dates (unlike json)
198
Does HTML5 solve some of the limitations of HTML4 when serving API's?
Some of them - but not all.
HTML5 defines a time tag
You can use HTML5's meter tag to define a number (sometimes)
HTML5 has some new attributes for embedding links - but none are very useful for API's.
HTML5 STILL can't trigger PUT or DELETE http actions.
199
What is an alternative format to HTML when creating API's?
HAL - Hypertext Application Language
200
What are the two primary concepts that HAL defines?
Links and Resources
201
The resource tag in HAL indicates what?
That the contents is a HTTP resource
202
What is the difference between a HAL link and a HTML link?
HAL links are completely generic hypermedia control. HTML implies certain HTTP verbs based on link type (i.e. is a GET request). HAL has only one hypermedia control - but it can control anything (i.e. PUT, GET, DELETE).
It can trigger ANY http request at all.
203
What is the major issue with HAL and Hypermedia links?
There is no machine readable information that indicates how a hypermedia control should be used - i.e. you have to include human readable documentation to indicate what the REL attribute should be doing?
HAL has no way of conveying protocol-semantics in a machine readable way.
204
How is the method of use of the Hypermedia link indicated in the HAL language?
It uses the REL attribute - but there are no defined reserved keywords.
205
What is Siren?
Siren is a general hypermedia format using JSON. It is designed to represent abstract groupings it calls entities. An entity may be a HTTP resource with it's own URL, but it does not have to be.
206
What makes Siren more useful than HAL and HTML?
Siren has an 'actions' component that allows the explicit declaration of the method that should be used with that resource. I.e. "method": "POST"
207
One of the fielding constraints is "Self describing..."
"messages". The server shouldn't have to guess what a HTTP request means, and the client shouldn't have to guess what a response means.
208
What does RFC 6906, 'profile' link relation specify?
It's a type of link relation that represents a profile - a way of telling a client about the application semantics.
209
What does the following indicate?
HTTP/1.1 200 OK
Content-Type: application/json
Link: ;rel="profile"
This is a response header that indicates that there is additional semantics on top of the json. This is indicated by the 'profile' relation.
210
Is it possible to link the profile to the media type directly in a HTTP response?
Yes - but only if the standard allows it. For example, the following is illegal:
application/json;profile="http://example.com/profile"
According to RFC4288 - you can only add the profile parameter on any random type - it has to support it, and JSON makes no mention of supporting the profile parameter.
(NOTE: application/collection+json DOES allow profile paramter).
211
What hypermedia types currently allow for the profile parameter?
Collection+JSON, JSON-LD, HAL, XHTML (but not HTML)
212
If you want to link a profile to a HTTP response header, and you aren't using one of the media types that support 'profile' parameters, what should you do?
Use the link header instead.
213
HTML5 microdata has an attribute that allows links to profiles - what is that attribute?
itemtype
< div itemscope itemtype="http://schema.org/Person">
214
The itemtype attribute of HTML5 microdata links to a profile - what does the profile do?
Provides an application semantics on top of the HTML5 microdata layer.
215
HTML4 also has a method for linking to a profile - what is it?
216
What does a profile contain?
Human readable prose that explains the use of the API.
217
What is the benefit of using a full featured hyper-media format - even when you could just provide a profile?
The profile only needs to include information about the application semantics, as the protocol semantics are already known.
218
Protocol sematics deal with...
HTTP requests
219
Application semantics refer to...
things in the real world
220
As the API designer you are responsible for documenting all of your link relations...
ahead of time, in a profile document, or in the definition of a custom media type (the only exception are those link relations taken from IANA).
221
If you use extension link relations (the ones that look like URL's) - what should they do?
If someone puts that link into a web browser, it should lead to an explanation of that link relation.
222
Can link relations result in 'unsafe' resource changes?
Yes - for instance a 'flip' relation, could indicate a switch is to be flipped - using a POST request. This would probably result in a change of state, and is therefore unsafe. It is however, completely valid.
223
What is a semantic descriptor?
It is a magic string that is used to identify a field in a way that relates back to a microformat or profile. i.e.
< span class="fn">Jenny
< span itemprop="name">Jenny
{ "name": "Jenny" }
All three of these are different ways to identify a name - fn is the hCard microformat way to describe a name for CSS. The microformat Person method is demonstrated second, followed by JSON twitter format.
224
In a Siren entity, is the class of the entity a semantic descriptor?
```
yes, as is name of the entities properties.
"class": ["person"],
"properties": { "name" : "Jenny" }
...
}
```
225
In ad-hoc json it's cusomary to see semantic descriptors used as...
object keys
226
In ad-hoc XML documents, tag names often correspond to semantic descriptors (i.e.
< person>
< name>Foomanchoo< /name>
Why is not recommended to design API's using adhoc JSON or XML?
Because they are only conventions, a client cannot rely on that being the same in other situations.
227
What is XMDP?
A microformat for explaining microformats.
228
Why is it fair to say that most modern API's don't use microformats?
Most modern API's are written using JSON or XML - microformats are a HTML feature, which is not often used these days.
229
What is the benefit of the ALPS's profile format?
The same format can describe the application semantics of many different document formats (i.e. JSON, SIREN, etc).
230
What is JSON-LD?
JSON for Linked Data - another API format
231
If you know that state transitions will be handled by an end user, and not an automated machine, you don't need embedded documentation - true or false?
False - the point of an API is that users will use it as they see fit - it's not possible to know how everyone will use the API.
232
What are the two different use cases for profiles vs embedded human readable documentation in hypermedia representations?
Profiles allow developers to write smart clients, Text embedded in a representation allows a human being to to use an application through a client that faithfully renders representations.
233
How can you improve the performance of an API?
Provide a cache in front of the API / reverse proxy.
234
What HTTP headers are relevant when telling a cache how to long to cache the data?
Cache-Control: max-age=N
or
Expires
235
Why can't the header of a http request be trusted?
It can be created very simply using curl or any other library - and is therefore prone to compromise.
236
How do you build a query string to be added to a url for use in a GET request?
```
$url = "http://www.example.com/get_pages";
$data = array("page" => 1, "numofpages" => 10);
$url = $url . http_build_query($data);
```
237
What does the function stream_context_create do?
When creating POST requests using stream functions (i.e. file_get_contents), you have to provide a context. Create an array of data providing context, and pass to the function - this will format the data in a way that the stream can understand.
$options = array(
"http" => array(
"method" => "POST",
"header" => "Content-Type: application/etc...",
"content" => http_build_query($data)
)
);
$page = file_get_contents($url, false, stream_context_create($options));
NOTE: http_build_query is working on an array, same format as if you were doing a GET request.
238
If you are not accessing GET or POST data, (say a non-standard verb) - how do you access that in PHP?
You can obtain it from "php://input"
$_PUT = array();
if($_SERVER['REQUEST_METHOD'] == 'PUT') {
parse_str(file_get_contents('php://input'), $_PUT);
}
NOTE: DO NOT FORGET THE SECOND argument to parse_str - otherwise they will be extracted as local variables. Danger William Robinson.
239
How can you determine what request method was used on the server?
$_SERVER["REQUEST_METHOD"] == 'PUT'
240
Is the header 'Cookie' sent with the request or the response?
Request - 'Set-Cookie' is sent with the response.
241
What is WURFL?
The Wireless Universal Resource File - a file that is used to match HTTP Request headers to the profile of the HTTP client (i.e. mobile / desktop etc.)
242
When it is appropriate to use WURFL?
Typically when you need to determine the platform (perhaps for display purposes) - for API's it's better to just let the client request a format type via the request headers - and provide it.
243
What header can you use to tell a server what kind of content the client can handle?
Accept:
i.e.
Accept: text/html, application/xhtml+xml
244
What must you consider when reading a Accept header?
Accept: text/html, application/xhtml+xml
Each element is it's own entity, and the order that they are sent indicates the order of preference.
245
Using Accept / Content-Type headers together to understand what to send and how to decode it is called what?
Content negotiation
246
What does the 'q' value in an accept header mean?
It indicates the level of preference for that particular content type. It's default is one, sometimes you will see in a Accept-Language: en-GB, en-US;q=0.8
247
How would you use HTTP Auth to secure a web service?
Arrange the username and password into format username:password. Base64 encode the result.
Send the data in the header:
Authorization: Base (the base 64 encoded string)
Make sure you are using HTTPS
248
Can 'unofficial' headers be used with HTTP?
yes - but they must be prefixed with X-
249
When a user first reaches a page - what is the order of transactions involved in setting up cookies?
1. Request arrives, without cookies
2. Response is made, with cookies
3. Next request arrives, with cookies
4. Response is made, with cookies (any updates, or not)
5. Repeat steps 2-3 ad infinitum
250
When a client first visits a site, are there cookies?
No - not until a reply is made containing the cookies to be written.
251
How would you set a value of a cookie "visited" to true?
setcookie("visited", true);
252
How would you set a cookie value via PHP's curl library?
curl_setopt($ch, CURLOPT_COOKIE, "visted=true");
253
Are session cookies the same as PHP cookies?
No - it is possible to use cookies in an API - but PHP session cookies is not that normal. It is more typical of an API to stateless and self contained.
But normally you wouldn't use cookies of any type - API's (RESTful ones anyway) typically have their state set by the client - and the API is just there to get it done. Using cookies makes this difficult.
254
What are some good reasons to use JSON for a data format?
It's lightweight, can be compressed well, doesn't take up much room so is good for 'over the wire' or mobile applications. Simple, well established format.
Useful to use when information about the exact data format is not critical and the effort needed to decode it must stay light.
255
When using JSON to send data, what is the difference in handling an array with keys and values and an object with properties?
Nothing - they will appear on the other end exactly the same.
256
Why should you keep any tokens files that you may use for securing an API in a separate file?
To prevent it from leaking publicly (it can be placed somewhere that can't be reached).
257
When should you use XML over JSON?
XML is very good for being able to pass detailed information, and also supports information about the type of data.
258
What method of creating XML in php is the most common?
SimpleXML since it is well documented, however it can't do everything - so DOM is sometimes used. There are conversion functions available - so a mix of the two is common.
259
Why might one choose to use XMLReader, XMLWriter and XMLParser over SimpleXML or DOM?
While complicated, these options have the advantage of not having to load the entire documenting in memory at once.
260
What is an RPC API?
A Remote Procedure Call API. RPC may use a the url string to encode a method parameter in which to notify the application which procedure to call. (NOTE THIS IS DIFFERENT TO TRUE XML-RPC)
261
What is XML-RPC?
Similar to RPC - i.e. a Remote Call Procedure -but the information on what to call and how to do it is passed in the body as a POST request
262
Given a class that returns (some form of) data - what is the simplest way to present that as an RPC API?
Just use a class to wrap it - the class will respond to input and call the appropriate methods, based on URL parameters.
263
Is there a difference between XML over RPC and XML-RPC?
Yes, XML-RPC is a very tight specification, whereas XML over RPC is simply any method that you use to send XML over an RPC style call.
Same with JSON over RPC and JSON-RPC
264
What is WSDL?
Web Services Description Language
A file that provides a machine readable definition of a web service, how to call it, what parameters it expects etc.
265
What tool can be used to browse a SOAP service?
soapUI
266
When is REST better than SOAP?
When you don't have to directly map a set of objects to a client. It can be very costly to send information about the objects back and forth - avoid in situations where a mobile has to use the API at all costs.
267
Can SOAP be used without WSDL?
Yes - it's referred to as "non-wsdl mode"
268
If a client has a SOAP WSDL file, what is the simplest way to get some data?
Use SoapClient();
$client = new SoapClient('http://api.example.com/soap2/?wsdl&v=latest');
$countries = $client->getCountryList();
var_dump($countries);
269
Are WSDL files usually created by hand?
No - while they can be, they are complicated. There are many tools for this - Eclipse has it, and there is a PHP tool called WSDLCreator
270
What is one gotcha with SOAP and WSDL files when using PHP?
PHP is dynamically typed, but some languages are not. WSDL is intended to contain type information - so it's possible you will get some mismatches. This is why many servers will use very generic types such as strings.
271
Are SOAP and REST protocols?
SOAP is a protocol, while REST is more of s philosophy.
272
What status code is often used when creating a new resource in REST?
201
273
What feature can you implement to prevent users hitting the system to frequently.
Rate limiting
274
What is 'leaking information' in the context of an API?
If a user without permission requests a resource, but is given a status code that indicates the resource exists, but they don't have permission - they now know that the resource is there - a status should be sent that gives not more information than is required.
275
Why is editing a record in REST a multiple step process?
First you need to get the record using GET, then update it, then return it using PUT to it's original API. REST deals with the representation of records, so the whole record must be fetched.
276
A REST record update is not an atomic operation (in that something can happen to the resource between the GET and the PUT), what is one 'high level' idea to deal with that?
Use the Last-Modified header or an ETag (ETag may not be totally appropriate?) - to determine when it was last modfied.
277
If it seems like overkill to GET an entire resource (user for example) just to update one field (email for example), what is an alternative?
You could create a sub resource (or use PATCH). For example, you could create a URI that just references an email resource of the user.
/user/42/email
278
Why is it problematic to use the PATCH verb?
Not all hardware supports the PATCH verb - so it may not be transmitted.
279
Why is using CURL to debug API's a good idea?
It removes the chance that the error is from the client. If the error goes away when using curl, then the client is probably at fault.
280
What is one major caveat of using debug output such as var_dump when debugging API's?
If the client is expecting JSON or XML, this could cause an issue.
281
Where are error logs normally written?
This is specified by the error_log directive in php.ini
282
How do you log an error to the PHP error log file?
error_log("This is an error");
283
How would you log an error to a specific file?
error_log("This is an error", 3, "log.txt");
NOTE: 3 means file
0 - PHP's system log
1 - Send by email to the address in the destination parameter
2 - no longer in use
3 - to a file
4 - Send message directly to SAPI message handler
284
If your API has functional features, what can be the biggest challenge in naming the API endpoints in a RESTful system?
REST apis should represent everything as a resource. But RESTful resources should not contain verbs - when an API uses functional features, this implies verbs.
285
Why are user stories useful in determining what data to send with each request?
Because it may not be clear as to how much data to send for each request. For example, in a blog system, do I only send a short digest of the blog body, or do I send all of it. Do I provide the user with flags they can set to specify how much of the data to send? Do I send the Author along with the body, what about the comments?
286
In an API, every customisable option should also have...
a default
287
In the name of consistency, an API that returns an array of results should return what when there are no results or one result?
an empty array, or a single element array. Always return the same type - consistency
288
Rather than passing error status codes back and forth up the application stack, what is one technique we could use to send consistent error messages back to the client?
Use an exception handler - use PHP's set_exception_handler to specify a function that will deal with uncaught exceptions. Then make sure it knows how to render the error in the correct format (probably defined through the content negotiation stage).
289
In an API that uses an MVC architecture, the first part of the url will describe what, and the second parameter will describe what?
The first will describe the location of the code (i.e. the controller) and the second will describe the method (action in MVC parlance) to call.
290
What term is used when describing the act of handing off data to a renderer (it's not specific to renderers).
Dispatch or dispatching
291
What is a heartbeat method?
A simple method that responds when requested to indicate that the API is alive and where you expect it to be.
292
What is the process of giving your database temporary test data called?
Seeding.
293
Why should you never use production data when developing an API?
You could accidentally send emails out to the list, or affect real data. Don't do it - use dummy data.
294
When determining what actions will be required in an API, does every action require a corresponding endpoint?
No - some actions will just be parameters to existing endpoints.
295
What is one of the downsides to using endpoints to retrieve a resource using an auto-increment id?
People using your API will know how many items are in your database - which may not be something you want to divulge.
296
If you can retrieve a specific 'place' with the following endpoint..
GET /places/x
What is the danger with the following delete request?
DELETE /places
This would indicate you want to delete all places, and it's an endpoint that should probably be avoided.
297
When could PUT be used to create a resource over POST?
When you know the full URL and the result is going to be idempotent. i.e.
PUT /images/1/image HTTP 1.1
Because we've specified the full URL (including id and image) - the act of uploading this multiple times will have the exact same result. This is idempotent.
298
Is it better to use singular or plural end points?
In the case of 'user'
/user/x will return a single user identified by x
/user should return all users. You could use /users - but this is not necessarily scalable, you may also run across words that either don't have a plural form or have unusual plural forms creating design issues for the endpoints. (i.e. opportunity vs opportunities)
It's probably best to stick with plural for all cases.
/opportunities/1 - Get the opportunity with id 1
/opportunties - Get all opportunities
299
Is this considered RESTful?
POST /users/5/send-message http 1.1
No - it is using a VERB in the url.
300
If we aren't putting verbs in the URL, where do the verbs come from?
The HTTP method.
301
If your API had the following endpoint to send a message, how would you change your API to accommodate sending multiple messages to many users?
POST /cainmartin/messages HTTP 1.1
You could create a messages end point that accepts many messages:
POST /messages HTTP 1.1
302
When we are coding a RESTful application, how do we map resources to code?
```
Through a controller. There should be one controller per type of resource. i.e.
CategoriesController
EventsController
UsersController
etc.
```
303
Is it okay to use the "automagical" route handlers in frameworks like CodeIgniter to handle RESTful routing?
In general no - they create a lot of issues that may not be obvious immediately. Plus in a framework like Laravel, you could manually define the routes in routes.php and it becomes self documenting.
