September 2017 Summaries

Dasun Hegoda, a Technical Lead at the Information and Communication Technology Agency in Sri Lanka, offers insights into best practices for designing REST APIs, emphasizing key aspects such as clarity, error handling, versioning, and security. Hegoda recommends making APIs as concrete as possible to avoid consumer confusion and highlights the importance of implementing CRUD operations through standard methods like GET, POST, PUT, and DELETE. He stresses the necessity of providing clear error messages and using HTTP status codes for effective error handling. The article also discusses the significance of API versioning for consistency, the use of filtering and pagination to manage data efficiently, and the critical role of security measures like HTTPS and access tokens. Additionally, Hegoda underscores the value of analytics derived from logging API requests and responses, the importance of comprehensive documentation, and maintaining stability and consistency through a well-structured URL format. Overall, the post serves as a detailed guide for developing robust and user-friendly REST APIs.

Unprotected web and mobile APIs pose significant risks to businesses by exposing them to potential attacks and data leaks. Common threats include uncontrolled API access, which enables unauthorized use and data exposure due to lack of proper authentication mechanisms, and inadequate monitoring, which prevents businesses from gaining insights into API usage and scaling effectively. Additionally, hastily developed APIs can incur high maintenance costs due to poor design and versioning issues, while insecure APIs may fail to meet industry compliance standards, leading to insecure communications and potential regulatory breaches. The risk of malicious attacks, such as Denial of Service, SQL injection, and XML attacks, further highlights the necessity for robust API security measures. Implementing an API management layer, conducting security audits, and following practical design principles are critical steps to mitigate these risks and protect business assets.