Web apis http

The status code meaning the request succeeded and the response normally carries the requested data or the result of the action. It is the standard success reply for GET and many other calls.

Example. GET /v1/models returns 200 with a JSON list of models.

Related: Status code, 201 Created, 204 No Content, GET

The status code meaning the request succeeded and a new resource was created. The response usually includes the new resource or a Location header giving its URL. It is the normal reply to a successful creation by POST.

Example. POST /users returns 201 with a Location header /users/88.

Related: Status code, POST, 200 OK, HTTP header

The status code meaning the request succeeded but the response deliberately has no body at all. It is common for deletions and updates where the client needs no data back, saving bandwidth.

Example. DELETE /notes/15 returns 204 and an empty body.

Related: Status code, 200 OK, Response body

The status code returned when a client sent a conditional request and the cached copy is still current. The response has no body, saving bandwidth, and the client reuses what it stored.

Example. A client sends If-None-Match: "abc"; the server sees it matches and replies 304.

Related: ETag, Cache-Control, Status code, Caching

The status code meaning the server could not understand the request because it was malformed, such as broken JSON or a missing required field. The client should fix the request before trying again.

Example. Sending {"name": } with a missing value returns 400.

Related: Status code, 422 Unprocessable Content, JSON, Request body

The status code meaning the request lacks valid credentials, for example a missing or expired token or a wrong API key. Despite its name it concerns authentication, and the response may say how to authenticate.

Example. Calling an API without an Authorization header returns 401.

Related: 403 Forbidden, Authentication, API key, Bearer token

The status code meaning the server understood who is calling but refuses the action because permission is lacking. Unlike 401, sending credentials again will not help; the account needs more rights.

Example. A student token calling an admin-only endpoint gets 403.

Related: 401 Unauthorized, Authorization, Scope, Status code

The status code meaning the server has no resource at the requested URL. It can reflect a typo, a deleted item or a server deliberately hiding a resource the caller may not see.

Example. GET /users/99999 returns 404 when no such user exists.

Related: Status code, URL, 400 Bad Request, Endpoint

The status code meaning the request clashes with the current state of the resource, such as creating something that already exists or updating with an outdated version. The client must resolve the conflict before retrying.

Example. Registering an email that is already in use returns 409.

Related: Status code, ETag, POST, 400 Bad Request

The status code meaning the request is well formed but its contents fail validation rules, such as an age of -5 or an invalid email. Frameworks like FastAPI use it for schema errors and list the failing fields.

Example. A valid JSON body with {"age": "abc"} where a number is required returns 422.

Related: 400 Bad Request, JSON Schema, Status code, Request body

The status code meaning the client has sent more requests than the rate limit allows in a time window. The response often includes a Retry-After header. Clients should slow down and retry using backoff.

Example. A script hammering an LLM API at 100 requests per second receives 429 and Retry-After: 20.

Related: Rate limiting, Retry-After, Exponential backoff, Status code

The generic status code meaning the server hit an unexpected fault while handling a valid request. It points to a bug or failure on the server side, so the caller can only retry later or report it.

Example. An unhandled exception in the server code makes it return 500.

Related: Status code, 502 Bad Gateway, 503 Service Unavailable, Retry

The status code returned by a proxy or gateway when the upstream server it forwarded to gave an invalid answer or was unreachable. It usually signals a problem behind the front door.

Example. A reverse proxy returns 502 while the application behind it is restarting.

Related: 504 Gateway Timeout, Reverse proxy, 503 Service Unavailable, API gateway

The status code meaning the server cannot handle the request right now, typically due to overload or maintenance. It is temporary, and may include Retry-After to say when to try again.

Example. An overloaded model API replies 503 during a traffic spike.

Related: Retry-After, 429 Too Many Requests, Exponential backoff, 500 Internal Server Error

The status code returned by a proxy or gateway when the upstream server did not respond in time. It suggests slow processing, such as a long model call exceeding the gateway's wait limit.

Example. A 60-second generation behind a gateway with a 30-second limit returns 504.

Related: 502 Bad Gateway, Timeout, Reverse proxy, API gateway

A request header in which the client lists the response formats it can handle, optionally ranked by preference. The server may use it to choose between formats such as JSON and XML.

Example. Accept: application/json asks the server to reply with JSON rather than HTML.

Related: Content-Type, HTTP header, JSON

A short-lived credential issued by an authorization server that an application presents to an API to act for a user with specific permissions. Its brief lifetime limits damage if it leaks.

Example. An access token valid for 60 minutes is sent as a Bearer token with each call.

Related: Refresh token, OAuth 2.0, Bearer token, JWT

An application programming interface is a defined way for one piece of software to ask another to do something, without knowing how the other works inside. It lists the available operations, the inputs each needs and the outputs returned. Web APIs let your code use services such as payments, maps or language models.

Example. A Python script calls a weather service with a city name and gets back the temperature as data.

Related: Web API, Endpoint, REST, JSON

A single entry point placed in front of many backend services that handles common tasks such as routing, authentication, rate limiting and logging before passing requests on. It keeps these concerns out of each service.

Example. A gateway checks the API key, applies a limit of 100 requests per minute, then routes /chat to the model service.

Related: Reverse proxy, Rate limiting, Authentication, Endpoint

A secret string issued to a developer and sent with each request to identify the calling project and allow billing and rate limits. It is simple but grants full access to anyone who holds it, so it must be kept out of public code.

Example. Storing OPENAI_API_KEY in an environment variable and sending it in a header instead of pasting it into a GitHub repository.

Related: Bearer token, Authentication, Authorization

Splitting a large result into smaller pages that a client fetches one at a time, so responses stay fast and small. APIs use page numbers, offsets or cursors, and return metadata pointing to the next page.

Example. GET /items?limit=50&page=3 returns items 101 to 150.

Related: Cursor pagination, Offset pagination, Query string, Endpoint

The practice of labelling different generations of an API, in the URL path, a header or a date, so that improvements can be released without breaking existing clients. Old versions are deprecated on a published schedule.

Example. Clients on /v1/orders keep working while new clients use /v2/orders with a changed response shape.

Related: Endpoint, REST, OpenAPI, Web API

The process of proving who a caller is, for example with a password, key or token. It answers 'who are you?' and comes before authorization, which decides what that caller may do.

Example. Logging in with a username and OTP authenticates you before the server checks your permissions.

Related: Authorization, API key, Bearer token, OAuth 2.0

The process of deciding what an already identified caller is allowed to do, such as which resources it can read or change. It answers 'what may you do?' and is enforced with roles, scopes or policies.

Example. A teacher account may edit marks while a student account can only view them.

Related: Authentication, Scope, 403 Forbidden, OAuth 2.0

An OAuth 2.0 flow in which the user signs in at the authorization server, which redirects back to the app with a one-time code. The app's backend then swaps that code for tokens. Tokens never pass through the browser URL, so it is the recommended flow for web apps.

Example. After clicking 'Sign in with Google', your app receives ?code=abc and exchanges it for an access token.

Related: OAuth 2.0, PKCE, Access token, Redirect

A simple scheme in which the client sends a username and password joined by a colon and encoded in Base64 inside the Authorization header. Encoding is not encryption, so it is safe only over HTTPS.

Example. Authorization: Basic dXNlcjpwYXNz decodes to user:pass.

Related: HTTPS, Base64, Authentication

A credential sent in the Authorization header as 'Bearer <token>' where whoever holds, or 'bears', the token is treated as the rightful caller. It is used with OAuth access tokens and JWTs and must travel only over HTTPS.

Example. Authorization: Bearer eyJhbGciOi... is attached to each API request.

Related: Access token, JWT, HTTPS

An HTTP header carrying caching instructions, such as max-age=3600 for how many seconds a copy is fresh, no-store to forbid saving, or private to allow only the user's own browser to keep it.

Example. Cache-Control: max-age=600 lets a copy be reused for 10 minutes.

Related: Caching, ETag, 304 Not Modified, HTTP header

Storing a copy of a response so later requests can be answered without repeating the work or the network trip. HTTP defines headers to say who may store a response and for how long. It cuts latency, cost and server load.

Example. A client stores a country list for 24 hours instead of requesting it on every page load.

Related: Cache-Control, ETag, 304 Not Modified, Latency

A resilience pattern in which a client stops calling a service after repeated failures, failing fast for a cooling-off period, then lets a few trial calls through to see if it has recovered. It protects both sides from wasted effort and cascading failures.

Example. After 5 consecutive errors, calls to a payment API are blocked for 30 seconds.

Related: Retry, Timeout, Exponential backoff, 503 Service Unavailable

An OAuth 2.0 flow in which a backend application authenticates as itself, using its own id and secret, to get an access token with no user involved. It suits server-to-server calls and scheduled jobs.

Example. A nightly data pipeline exchanges its client id and secret for a token to call an internal reporting API.

Related: OAuth 2.0, Access token, API key, Scope

Also called an SDK, a package published by an API provider that wraps its endpoints in functions for a specific language, handling authentication, retries and data parsing so developers write less HTTP code.

Example. pip install openai lets Python code call client.chat.completions.create(...) instead of building the request by hand.

Related: API, Serialization, Retry, Endpoint

An HTTP header naming the media type of the body being sent, such as application/json, text/html or multipart/form-data, so the receiver knows how to read it. Sending JSON with the wrong value is a frequent cause of rejected requests.

Example. Content-Type: application/json must accompany a JSON body, otherwise many servers respond with 415.

Related: Accept header, JSON, Request body, Multipart form data

A small piece of data a server asks the browser to store and send back with later requests to the same site. Cookies keep users logged in and remember settings. Flags such as HttpOnly, Secure and SameSite control how safe they are.

Example. After login, Set-Cookie: session_id=abc; HttpOnly; Secure makes the browser send the id on every request.

Related: HTTP header, CSRF, Same-origin policy

Cross-Origin Resource Sharing is a browser mechanism by which a server states, through response headers, which other origins may call it from web pages. Without permission, browsers block the page from reading the response. It is enforced by browsers, not by scripts like curl.

Example. An API sets Access-Control-Allow-Origin: https://myapp.in so only pages from myapp.in can read its responses.

Related: Same-origin policy, Preflight request, OPTIONS, HTTP header

Cross-Site Request Forgery is an attack in which a malicious site makes a logged-in user's browser send an unwanted request to another site, relying on cookies being sent automatically. Defences include anti-forgery tokens and SameSite cookies.

Example. A hidden form on a bad page submits a transfer request to your bank while your session cookie is active.

Related: Cookie, Same-origin policy, CORS

A pagination style where each page response includes an opaque marker pointing to where it ended, and the client sends it back to get the next page. It stays stable when data changes and is efficient on large datasets.

Example. The response has next_cursor: "eyJpZCI6MTIwfQ"; the next call adds ?cursor=eyJpZCI6MTIwfQ.

Related: Offset pagination, Endpoint, Query string

The HTTP method that asks the server to remove the resource at a URL. Repeating it should leave the same end state, since the item is already gone, so it counts as idempotent even though later calls may report not found.

Example. DELETE /notes/15 removes note 15; a second call may return 404.

Related: HTTP method, 404 Not Found, 204 No Content

Rebuilding an in-memory object from stored or received text or bytes. In web code it means parsing a JSON response into dictionaries or objects. Data from untrusted sources should be validated after parsing.

Example. json.loads('{"a": 1}') returns a Python dictionary {'a': 1}.

Related: Serialization, JSON, JSON Schema, Response body

A specific URL, together with an allowed method, at which an API accepts requests to perform one operation. Each endpoint has a defined input and output. Documentation for any API is essentially a list of its endpoints.

Example. POST https://api.example.com/v1/embeddings is an endpoint that turns text into number vectors.

Related: URL, HTTP method, API, Path parameter

An HTTP header holding an identifier for a specific version of a resource, such as a hash of its content. A client sends it back in If-None-Match to ask whether it changed, and can also use it to avoid overwriting newer edits.

Example. ETag: "v42" is returned; the client later sends If-None-Match: "v42" and receives 304 if nothing changed.

Related: 304 Not Modified, Caching, Cache-Control, 409 Conflict

A retry strategy in which the wait between attempts grows by a multiplying factor, for example 1, 2, 4 then 8 seconds, so struggling servers get breathing room instead of a flood of repeats. It is recommended for calls to rate-limited AI APIs.

Example. delay = base * 2 ** attempt gives 1 s, 2 s, 4 s, 8 s for attempts 0 to 3.

Related: Jitter, Retry, Rate limiting, 429 Too Many Requests

The HTTP method used to fetch a representation of a resource without changing anything on the server. It carries no request body by convention, can be cached and is safe to repeat. Inputs go in the URL path or query string.

Example. GET /v1/models returns the list of available models as JSON.

Related: HTTP method, Query string, Cache-Control

A query language and runtime for APIs in which the client writes a query describing exactly the fields it wants, and the server returns just that in one response. It uses a typed schema and typically a single endpoint, which avoids fetching too much or too little.

Example. query { student(id: 1) { name marks } } returns only name and marks for student 1.

Related: REST, Endpoint, JSON, OpenAPI

An open-source remote procedure call framework, created at Google, in which services and messages are defined in Protocol Buffers and calls run over HTTP/2. It is compact and fast and supports streaming, so it is common between internal services and in model serving.

Example. A recommendation service calls a ranking service using a generated Python stub instead of hand-building HTTP requests.

Related: RPC, HTTP/2, REST

An HTTP method that asks for the same headers a GET would return but without the body. Clients use it to check whether a resource exists, its size or its modification time cheaply.

Example. HEAD /files/report.pdf returns Content-Length so a script can see the file is 12 MB before downloading.

Related: GET, HTTP header, HTTP method, ETag

A Hash-based Message Authentication Code is a short tag produced by mixing a message with a secret key using a hash function. Anyone holding the key can recompute it to verify origin and integrity. It is used for webhook signatures and signed requests.

Example. hmac.new(secret, body, hashlib.sha256).hexdigest() yields the signature for a webhook body.

Related: Webhook signature, JWT, Authentication, Webhook

The Hypertext Transfer Protocol is the set of rules a client and a server follow to exchange messages on the web. The client sends a request naming what it wants, and the server sends back a response. Almost every website and web API runs on it, so it is the base skill for calling any AI model over the internet.

Example. Your browser opens a Flipkart product page by sending a request line 'GET /product/123' and receiving an HTML page in the response.

Related: HTTP request, HTTP response, HTTPS, Status code

A name-value line attached to a request or response that carries metadata, such as the format of the body, credentials, caching rules or the client's identity. Headers keep this information separate from the actual data.

Example. Authorization: Bearer abc123 tells the server who is calling, while Content-Type: application/json describes the body.

Related: Content-Type, Authorization, Cache-Control, User-Agent

A verb in a request that tells the server what kind of action is wanted on the resource, such as reading, creating, replacing, updating or deleting. The most common are GET, POST, PUT, PATCH and DELETE, and each has agreed rules about safety and repeatability.

Example. Sending POST /orders asks the server to create a new order, whereas GET /orders only lists them.

Related: GET, POST, PUT

A message from a client to a server made of a request line (method, path, protocol version), headers and an optional body. It tells the server which resource is wanted, how, and with what data or credentials.

Example. POST /v1/notes HTTP/1.1, Host: api.example.com, Content-Type: application/json, followed by a JSON body.

Related: HTTP response, HTTP header, Request body, HTTP method

The message a server returns for a request, made of a status line (protocol version, status code, reason), headers and usually a body. Clients read the status code first to decide whether the call worked.

Example. HTTP/1.1 200 OK, Content-Type: application/json, then a body {"id": 5}.

Related: HTTP request, Status code, HTTP header, Response body

A major revision of the web protocol that sends many requests at once over a single connection, compresses headers and uses a binary framing layer. It reduces delay compared with HTTP/1.1 and is the transport for gRPC.

Example. A browser fetches page scripts, images and styles in parallel over one HTTP/2 connection.

Related: gRPC, HTTP

The secure form of the web protocol, in which all messages travel inside an encrypted channel set up by TLS. It stops eavesdroppers from reading passwords or API keys in transit and lets a client check it is talking to the real server. Modern APIs and browsers expect it by default.

Example. Calling https://api.example.com/v1/chat keeps your API key hidden from anyone sharing the same café Wi-Fi in Bengaluru.

Related: TLS, HTTP, API key

A unique value, usually a random string sent in a header, that a client attaches to a request so the server can recognise a retry of the same operation and return the original result instead of running it twice. Payment APIs rely on it to avoid double charges.

Example. A client sends Idempotency-Key: 7f3a... with a payment call; after a timeout it resends the same key and is charged only once.

Related: Retry, POST, HTTP header

A small random amount added to retry delays so that many clients that failed together do not all retry at the same instant. It prevents synchronised bursts that can overload a recovering service.

Example. Wait time = 2 ** attempt + random.uniform(0, 1) seconds.

Related: Exponential backoff, Retry, Rate limiting

JavaScript Object Notation is a lightweight text format for structured data, built from objects (key-value pairs in braces), arrays (ordered lists in brackets), strings, numbers, booleans and null. It is easy for people to read and for programs to parse, which makes it the usual format for web API messages.

Example. {"city": "Pune", "temp_c": 31.5, "tags": ["humid", "cloudy"]} is a JSON object with three fields.

Related: Serialization, Deserialization, JSON Schema, Content-Type

A vocabulary for describing the structure of JSON data: required fields, types, allowed ranges and patterns. Validators check documents against it. It is also used to describe the inputs of tools that language models can call.

Example. {"type": "object", "required": ["age"], "properties": {"age": {"type": "integer", "minimum": 0}}} rejects a document without age.

Related: JSON, OpenAPI, 422 Unprocessable Content, Request body

A JSON Web Token is a compact signed string with three dot-separated parts: a header, a payload of claims and a signature. A server can verify it without a database lookup, so it is widely used as a bearer token, though its payload is readable by anyone.

Example. eyJhbGci....eyJzdWIiOiI0MiJ9....SflKxw carries a payload such as {"sub": "42", "exp": 1750000000}.

Related: Bearer token, JWT claims, Access token, HMAC

The statements stored in a JSON Web Token payload, such as sub (subject), iss (issuer), aud (audience) and exp (expiry time). Servers check them, especially exp and aud, before trusting the token.

Example. A payload with exp earlier than the current time causes the server to reject the token.

Related: JWT, Access token, Bearer token, OpenID Connect

A variant of polling where the server holds the request open until new data is available or a timeout expires, then replies, and the client immediately asks again. It gives near-real-time updates using ordinary HTTP.

Example. A chat client sends a request that the server answers only when a new message arrives, then reconnects.

Related: Polling, WebSocket, Server-Sent Events, Timeout

A request body format that packs several parts, such as text fields and files, into one message separated by boundary strings. It is the standard way to upload files, images or audio to an API.

Example. curl -F file=@notes.pdf -F purpose=upload sends a PDF plus a text field in one request.

Related: Content-Type, Request body, POST, URL encoding

An authorization framework that lets a user grant an application limited access to their account at another service without sharing their password. The app obtains a token from an authorization server and presents it to the resource server.

Example. A resume-parsing app asks for read access to your Google Drive; you approve and Google issues it a token.

Related: Access token, Refresh token, Authorization code flow, Scope

A pagination style where the client says how many items to skip and how many to return, for example offset=100 and limit=50. It is easy to use, but results can shift if items are added meanwhile and large offsets are slow.

Example. GET /tweets?offset=200&limit=20 skips the first 200 items.

Related: Cursor pagination, Query string, Endpoint

A standard, machine-readable format, written in YAML or JSON, for describing a REST API: its endpoints, parameters, request and response shapes and authentication. Tools use it to generate documentation, client libraries and tests. FastAPI produces it automatically.

Example. openapi.yaml lists GET /users/{id} with a 200 response schema, and a tool builds a Python client from it.

Related: Swagger UI, JSON Schema, REST, Endpoint

An identity layer built on top of OAuth 2.0 that lets an application learn who the user is, not just obtain access. It adds an ID token, usually a JWT, holding claims like name and email verified by the provider.

Example. Signing in to a job portal with a Google account uses OpenID Connect to give the portal your verified email.

Related: OAuth 2.0, JWT, Authentication, Access token

An HTTP method that asks a server which methods and headers are allowed for a URL. Browsers send it automatically as a preflight request before certain cross-origin calls, so servers supporting browser clients must answer it correctly.

Example. A web page at app.example.com sends OPTIONS to api.example.com to learn whether a POST with a JSON body is permitted.

Related: CORS, Preflight request, HTTP method, HTTP header

The HTTP method for a partial update: the body describes only the fields to change rather than the whole resource. It is handy for large records, though whether repeating it is safe depends on how the change is written.

Example. PATCH /profiles/8 with {"city": "Kochi"} changes only the city.

Related: PUT, HTTP method, Request body

A variable segment inside the path of a URL that identifies a particular resource, such as an id. It differs from query parameters, which are optional and follow the question mark.

Example. In /users/42/posts/9, the values 42 and 9 are path parameters selecting one user and one post.

Related: Endpoint, Query string, Resource, URL

The main data carried by a message, as distinct from the headers and other overhead around it. In APIs it means the body of a request or response, or the data inside an event or token.

Example. The JSON object sent in a POST call is its payload.

Related: Request body, Response body, JSON, JWT

Proof Key for Code Exchange is an extension to the OAuth authorization code flow in which the client creates a random secret, sends a hash of it at the start and reveals the original when exchanging the code. It prevents a stolen code from being used, which suits mobile and single-page apps.

Example. A mobile app generates a code_verifier, sends its SHA-256 as code_challenge and later proves it holds the verifier.

Related: Authorization code flow, OAuth 2.0, Access token, Redirect

A technique where a client repeatedly asks a server at regular intervals whether something has changed or a job has finished. It is simple but wasteful when little changes, so webhooks or streaming are preferred for frequent updates.

Example. A script checks GET /jobs/12 every 5 seconds until the status becomes done.

Related: Long polling, Webhook, Server-Sent Events, Rate limiting

The HTTP method used to send data to a server so it can process it, most often to create a new resource or trigger an action. The data travels in the request body. Repeating it can create duplicates, so it is not idempotent.

Example. POST /v1/chat/completions with a JSON body of messages asks a language model API for a reply.

Related: HTTP method, Request body, Idempotency key

A desktop and web application for building, sending and saving HTTP requests through a graphical interface, and for organising them into collections and tests. It is popular for exploring an API before writing code.

Example. Import an OpenAPI file into the app, click an endpoint, add your API key and press Send.

Related: API, Endpoint, OpenAPI

An automatic OPTIONS request that a browser sends before certain cross-origin calls, such as those with JSON bodies or custom headers, to ask whether the real request is allowed. The real call proceeds only if the reply permits it.

Example. Before a POST with an Authorization header from another site, the browser sends OPTIONS and checks the Access-Control-Allow-* headers.

Related: CORS, OPTIONS, Same-origin policy, HTTP header

The HTTP method that replaces the entire resource at a URL with the data in the request body, or creates it if absent. Sending the same request twice leaves the server in the same state, so it is idempotent.

Example. PUT /profiles/8 with a full profile document overwrites every field of profile 8.

Related: PATCH, HTTP method, POST

The part of a URL after the question mark, made of key=value pairs joined by ampersands, used to pass optional inputs such as filters, search text or page numbers to the server. Values with special characters must be encoded.

Example. In /search?q=biryani&city=Hyderabad&limit=5 the query string carries three parameters.

Related: URL, Path parameter, URL encoding

A control that caps how many requests a client may make in a period, such as 60 per minute, to protect servers from overload and abuse and to share capacity fairly. Exceeding it typically returns a 429 status.

Example. A free API plan allows 100 requests a minute, and the 101st receives 429.

Related: 429 Too Many Requests, Retry-After

A 3xx response telling the client the resource is elsewhere, with the new address in the Location header. 301 marks a permanent move and 302, 307 or 308 a temporary one. Clients such as browsers and HTTP libraries usually follow it automatically.

Example. Visiting http://example.com returns 301 to https://example.com, and the browser follows.

Related: Status code, HTTP header, HTTPS, URL

A longer-lived credential that an application can exchange for a new access token when the old one expires, without asking the user to sign in again. It must be stored securely because it can mint new tokens.

Example. When a 60-minute access token expires, the app posts its refresh token to the token endpoint to get another.

Related: Access token, OAuth 2.0, Bearer token, Authentication

The data a client sends after the headers of a request, used mainly with POST, PUT and PATCH. Its format is declared by the Content-Type header, and JSON is the most common choice for APIs.

Example. {"model": "small", "prompt": "Hello"} sent with a POST is a JSON request body.

Related: POST, Content-Type, JSON, Payload

In web API design, a resource is a thing the API exposes, such as a user, an invoice or a document, that has its own URL and can be read or changed. Naming APIs around nouns rather than actions keeps them consistent.

Example. /users/7/orders names the collection of orders belonging to user 7.

Related: REST, Endpoint, URL, HTTP method

The data a server sends back after the headers of a response, such as HTML for a page or JSON for an API. Clients parse it according to the Content-Type header, and error responses often put details in it.

Example. {"error": "invalid_api_key"} returned along with a 401 status is a response body describing the failure.

Related: HTTP response, Content-Type, JSON, Status code

Representational State Transfer is an architectural style for web APIs in which everything is a resource identified by a URL, and standard HTTP methods act on it. Requests are stateless, meaning each one carries all the information the server needs. The style keeps APIs predictable and easy to scale.

Example. GET /students/42 reads student 42, DELETE /students/42 removes that student, and neither call depends on earlier calls.

Related: RESTful API, HTTP method, Stateless, Resource

A web API that follows the constraints of the REST style: resources named by URLs, standard methods for actions, stateless requests and predictable status codes. It is a description of how well an API follows the style, not a formal certification.

Example. An order service offering GET /orders, POST /orders and GET /orders/17 with JSON bodies is usually called RESTful.

Related: REST, Endpoint, HTTP method, Status code

Sending a failed request again, in the hope that a temporary fault has cleared. Sensible clients retry only transient errors such as timeouts, 429 or 5xx, limit the attempts and wait between them.

Example. A script retries a call up to 3 times when it receives 503 but never retries a 400.

Related: Exponential backoff, Timeout, Circuit breaker

An HTTP response header telling a client how long to wait, in seconds or as a date, before sending another request. Servers include it with 429 or 503 responses, and well-behaved clients honour it.

Example. Retry-After: 30 tells the client to wait 30 seconds.

Related: 429 Too Many Requests, 503 Service Unavailable, Exponential backoff, Rate limiting

Remote procedure call is a style where a program calls a function that actually runs on another machine, with the network details hidden. It contrasts with resource-oriented REST by focusing on actions, and gRPC and JSON-RPC are examples.

Example. Calling get_price(item_id) in code triggers a request to a pricing server and returns its result.

Related: gRPC, REST, SOAP, API

A browser security rule that stops scripts on a page from reading data from a different origin, where an origin is the combination of scheme, host and port. It protects users from malicious sites, and CORS is the controlled way to relax it.

Example. A script on evil.com cannot read your bank's pages open in another tab.

Related: CORS, Cookie, CSRF, Preflight request

In OAuth, a named permission an application asks for, such as read:email or write:files. The token issued is limited to the granted scopes, following the principle of giving only the access needed.

Example. An app requests scope calendar.readonly and so cannot create events.

Related: OAuth 2.0, Authorization, Access token, 403 Forbidden

A standard where a server keeps one HTTP connection open and pushes a stream of text events to the client, in one direction only. Browsers reconnect automatically. It is the usual way chat APIs stream generated tokens.

Example. A language model API streams each new word as a data: line, ending with data: [DONE].

Related: Streaming response, WebSocket, Long polling, Content-Type

Simple Object Access Protocol is an older messaging standard for web services in which requests and responses are XML envelopes with strict contracts described in WSDL files. It is verbose but still used in banking and enterprise systems.

Example. A bank integration sends an XML envelope calling GetBalance and receives an XML reply.

Related: REST, RPC, Web API

A property of a server design in which each request is handled entirely from the information it contains, with no memory of earlier requests kept between calls. Statelessness lets any server in a pool answer any request, which makes systems easier to scale and recover.

Example. Each API call carries its own token, so a load balancer can send call 1 to server A and call 2 to server B.

Related: REST, Bearer token

A three-digit number at the start of an HTTP response that summarises the outcome. Ranges are 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. Programs branch on it to decide whether to use, fix or retry a call.

Example. A script treats 200 as success, 404 as a wrong URL and 503 as a reason to retry later.

Related: 200 OK, 404 Not Found, 500 Internal Server Error, HTTP response

A reply delivered in pieces as it is produced rather than all at once, so the client can start using data early. In AI APIs it lets a chat UI show tokens as they are generated, cutting perceived waiting time.

Example. Setting stream=true on a chat request returns many small chunks instead of one big JSON object.

Related: Server-Sent Events, Latency, WebSocket

An interactive web page generated from an OpenAPI description that shows every endpoint of an API and lets you try requests directly in the browser. FastAPI serves one at /docs by default.

Example. Opening /docs on a FastAPI app lets you click 'Try it out' and send a request without writing code.

Related: OpenAPI, Endpoint, REST, API

A maximum time a client will wait for a connection or response before giving up and raising an error. Without one, a program can hang forever on a stalled server, so every network call should set it.

Example. requests.get(url, timeout=10) fails if no reply arrives within 10 seconds.

Related: Retry, 504 Gateway Timeout, Circuit breaker, Latency

Transport Layer Security is the protocol that encrypts data between a client and server and verifies the server's identity with a certificate. It is what turns plain HTTP into HTTPS and successor to the older SSL.

Example. A TLS handshake agrees on encryption keys before your API key is sent.

Related: HTTPS, HTTP, Authentication

A Uniform Resource Identifier is a string that names a resource, either by location or by name. A URL is the common kind that says where to find it. The word appears in standards documents and in OAuth as redirect URI.

Example. urn:isbn:9780131103627 is a URI that names a book without saying where to fetch it.

Related: URL, OAuth 2.0, Endpoint, URL encoding

A Uniform Resource Locator is the address of a resource on the web, made of a scheme (https), a host (example.com), an optional port, a path (/v1/items), an optional query string and an optional fragment. It tells a client where to send a request.

Example. https://api.example.com:443/v1/items?limit=10 has host api.example.com, path /v1/items and query limit=10.

Related: URI, Query string, Endpoint, URL encoding

A way of writing characters that are not allowed or have special meaning in a URL as a percent sign followed by two hex digits, so a space becomes %20. It keeps query values from breaking the address.

Example. The query q=chai & samosa is sent as q=chai%20%26%20samosa.

Related: Query string, URL, URI, Multipart form data

A request header in which a client identifies itself, naming the browser, library or app and its version. Servers use it for analytics and to tailor responses, and some APIs ask you to set a meaningful one.

Example. User-Agent: python-requests/2.x tells the server the call came from the requests library.

Related: HTTP header, HTTP request, Rate limiting

An API that is reached over the network using web protocols, typically by sending HTTP requests to a URL and reading a structured reply such as JSON. Because it works across languages and machines, one service can be used by mobile apps, websites and scripts alike.

Example. A UPI payment app calls a bank's web API with an account and amount and receives a success or failure message.

Related: API, HTTP, REST, JSON

A way for one service to notify another by sending an HTTP POST to a URL you provide when something happens, instead of you repeatedly asking. It reverses the usual flow and delivers events quickly with little wasted traffic.

Example. Razorpay posts a payment.captured event to your /webhook URL as soon as a customer pays.

Related: Polling, Webhook signature, HMAC, POST

A value the sender computes over the webhook body with a shared secret and sends in a header, so the receiver can recompute it and confirm the message is genuine and unchanged. Checking it stops attackers from posting fake events to your URL.

Example. A receiver computes HMAC-SHA256 of the raw body with its secret and compares it with the X-Signature header.

Related: Webhook, HMAC, HTTP header, Authentication

A protocol that upgrades an HTTP connection into a persistent two-way channel, allowing client and server to send messages to each other at any time with low overhead. It suits live chat, games and dashboards.

Example. A trading dashboard opens wss://feed.example.com and receives price ticks continuously.

Related: Server-Sent Events, Long polling, HTTP, gRPC