API Cheat Sheet

API Cheat Sheet: REST, HTTP Methods, Status Codes & Examples

An API (Application Programming Interface) allows different software applications or components to communicate with each other through a defined set of rules.

APIs power many everyday digital experiences, including online payments, social media integrations, weather applications, e-commerce websites, marketing platforms, and AI tools.

This cheat sheet explains the essential API concepts, terminology, HTTP methods, status codes, authentication mechanisms, and practical examples beginners should understand.

1. What Is an API?

An API defines how one software component can request functionality or data from another component.

For example, a weather application may use a weather service's API to retrieve current temperature information and display it to users.

How an API Works

1. A client sends a request.

2. An API receives and processes the request.

3. The server performs the required operation.

4. The API returns a response.

5. The client processes and displays the result.

Example: A website requests product information from an e-commerce API and displays the returned product name, price, and availability.

Common API Use Cases

• Payment processing.

• Login and authentication.

• Weather information.

• Maps and navigation.

• Customer relationship management integrations.

• Marketing analytics and reporting.

• Social media publishing.

• AI-powered applications.

• Data exchange between business systems.

2. Essential API Terminology

3. Types of APIs

APIs can be classified by their access model or communication style.

By Access Model

Public APIs: Available to external developers under the provider's access rules.

Private APIs: Intended for internal systems within an organization.

Partner APIs: Available to approved partners through specific agreements or permissions.

Composite APIs: Combine multiple operations or data sources into a single interaction.

These categories describe access and usage patterns rather than completely separate technical protocols.

By Communication Style

The appropriate approach depends on the application, integration requirements, infrastructure, and performance needs.

4. What Is a REST API?

REST stands for Representational State Transfer. It is an architectural style commonly used to design web APIs.

REST APIs often expose resources through URLs and use HTTP methods to perform operations on those resources.

Example resource endpoints:

GET    https://api.example.com/products
GET    https://api.example.com/products/101
POST   https://api.example.com/products
PUT    https://api.example.com/products/101
PATCH  https://api.example.com/products/101
DELETE https://api.example.com/products/101

These are illustrative endpoints, not live services.

Common REST Concepts

• Resources are identified by URLs.

• HTTP methods indicate the intended operation.

• Requests and responses use representations such as JSON.

• Statelessness means each request contains the information needed to process it, rather than depending on stored client session state for its meaning.

• Properly designed REST systems follow additional architectural constraints.

Not every API that uses HTTP and JSON necessarily conforms fully to REST.

5. HTTP Methods

HTTP methods indicate what a client intends to do.

Actual behavior depends on the API contract.

GET Example

GET /products/101 HTTP/1.1
Host: api.example.com
Accept: application/json

The client requests product 101.

POST Example

POST /products HTTP/1.1
Host: api.example.com
Content-Type: application/json

Example JSON request body:

{
  "name": "Notebook",
  "price": 150
}

The server may create the product and return its identifier.

PUT vs. PATCH

• PUT generally represents replacing the target resource's state.

• PATCH represents applying partial modifications.

The exact fields required and update semantics depend on the API's documentation.

6. HTTP Status Codes

Status codes indicate the general result of an HTTP request.

2xx — Success

3xx — Redirection

4xx — Client-Side Request Issues

A 401 usually concerns authentication, whereas 403 usually indicates that the request is not permitted. Implementations can vary in how they handle certain cases.

5xx — Server-Side Issues

Important: A status code provides a starting point for troubleshooting. Check the response body and API documentation for the specific cause.

7. API Request Structure

An HTTP request can contain a method, URL, headers, and a body.

Example:

POST /orders HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer YOUR_ACCESS_TOKEN

{
  "product_id": 101,
  "quantity": 2
}

Request Components

• Method: The intended operation.

• URL: The destination resource.

• Headers: Metadata and authentication information.

• Body: Data being submitted, when applicable.

Some requests, such as many GET requests, do not require a body.

8. API Response Structure

A response typically contains a status code, headers, and possibly a body.

Example JSON response:

{
  "order_id": 5001,
  "status": "confirmed",
  "total": 300
}

A client can parse the response and use the values in its application.

Responses may also contain error information:

{
  "error": {
    "code": "INVALID_QUANTITY",
    "message": "Quantity must be greater than zero."
  }
}

Error formats differ between APIs. Never assume every API uses the same field names or response structure.

9. JSON: A Common API Data Format

JSON stands for JavaScript Object Notation. It is a text-based format for exchanging structured data.

Example:

{
  "name": "Alex",
  "age": 25,
  "active": true,
  "skills": ["Python", "SQL", "APIs"],
  "address": null
}

JSON Data Types

• String: "Alex"

• Number: 25

• Boolean: true or false

• Array: ["Python", "SQL"]

• Object: {"name": "Alex"}

• Null: null

JSON uses double quotes for strings and property names. Unlike Python dictionaries, JSON does not use True, False, or None; it uses true, false, and null.

10. API Authentication and Authorization

APIs often require clients to prove their identity or demonstrate permission to perform an operation.

API Keys

An API key identifies a client or application and may be used for access control or usage tracking.

Bearer Tokens

A bearer token is commonly sent in the Authorization header:

Authorization: Bearer YOUR_ACCESS_TOKEN

Anyone who obtains a valid bearer token may be able to use its permissions, so tokens must be protected.

OAuth 2.0

OAuth 2.0 is an authorization framework that allows applications to obtain limited access to resources.

It is commonly used when applications need permission to access data or perform operations on behalf of a user.

Basic Authentication

Basic authentication sends a username and password in an encoded form. Encoding is not encryption, so it must be protected by HTTPS and used only where appropriate.

Authentication vs. Authorization

Never place API keys, passwords, or access tokens in public source code, public repositories, or URLs unless the provider explicitly requires a safe, documented mechanism.

11. Query Parameters and Path Parameters

Parameters help identify resources or refine a request.

Path Parameter

GET /products/101

Here, 101 identifies the requested product.

Query Parameters

GET /products?category=books&limit=10

The parameters specify a category and a result limit.

Common uses include:

• Filtering.

• Sorting.

• Pagination.

• Search terms.

• Date ranges.

• Selecting particular fields.

Parameter names and accepted values are defined by each API.

12. Headers You Should Know

For JSON requests, clients commonly send:

Content-Type: application/json
Accept: application/json

An API may require additional headers or support different formats.

13. Pagination, Filtering, and Sorting

Large API responses are often split into smaller pages.

Pagination

A page-number API might use:

GET /products?page=2&limit=20

Other APIs use offset-based pagination:

GET /products?offset=20&limit=20

Some APIs return a cursor or a next URL for retrieving the next page.

Always follow the provider's documented pagination method. Do not assume page numbers or offsets are supported.

Filtering

GET /orders?status=completed

Sorting

GET /products?sort=price&order=asc

These are examples of possible API conventions, not universal standards.

14. Rate Limits and API Quotas

A rate limit restricts how frequently a client can call an API.

For example, an API might allow a certain number of requests per minute or day.

When an API returns 429 Too Many Requests:

1. Read the error response.

2. Check for a Retry-After header.

3. Wait before retrying.

4. Use exponential backoff when appropriate.

5. Cache results if permitted.

6. Reduce unnecessary requests.

7. Review the provider's quota and usage policies.

Some APIs also enforce monthly quotas, concurrent-request limits, or account-specific usage restrictions.

15. What Is an API Endpoint?

An endpoint is a specific address used to access an API resource or operation.

Example base URL:

https://api.example.com/v1

Example endpoints:

GET    /products
GET    /products/101
POST   /orders
GET    /orders/5001

The base URL identifies the API service, while the path identifies a resource or operation within it.

An endpoint is not necessarily equivalent to an entire API; one API commonly provides many endpoints.

16. Testing APIs

API testing verifies that requests, responses, validation rules, security, and business logic behave as expected.

Common Testing Tools

• Postman.

• Insomnia.

• curl.

• Automated test frameworks.

• Browser developer tools for relevant web requests.

Basic API Testing Checklist

1. Confirm the correct base URL and endpoint.

2. Select the documented HTTP method.

3. Include required headers.

4. Supply valid authentication credentials.

5. Send a valid request body when required.

6. Verify the status code.

7. Validate response fields and data types.

8. Test missing and invalid inputs.

9. Test permission restrictions.

10. Check pagination and rate-limit behavior.

11. Review error handling.

12. Avoid exposing credentials in logs or shared screenshots.

17. Example: Calling an API With Python

The following example uses Python's requests library to call a public test endpoint.

import requests

url = "https://jsonplaceholder.typicode.com/posts/1"

response = requests.get(url, timeout=10)

response.raise_for_status()

data = response.json()

print(data["title"])

Install the library if it is not already available:

python -m pip install requests

What the Code Does

• requests.get() sends an HTTP GET request.

• timeout=10 limits how long the client waits for the request.

• raise_for_status() raises an exception for unsuccessful HTTP status codes.

• response.json() parses the JSON response.

• data["title"] retrieves the title field.

This is a public test service, so it is suitable for basic learning. Real APIs may require authentication and have different availability or usage rules.

18. Common API Errors and Troubleshooting

A successful HTTP response does not automatically mean the business operation produced the expected result. Validate the returned data as well.

19. API Security Best Practices

• Use HTTPS for sensitive communication.

• Protect API keys and access tokens.

• Use least-privilege permissions.

• Validate incoming data.

• Apply authentication and authorization correctly.

• Avoid exposing sensitive information in error messages.

• Implement appropriate rate limits.

• Use timeouts and controlled retries.

• Rotate credentials when required.

• Store secrets in environment variables or a secret-management system.

• Avoid logging passwords, tokens, or sensitive payloads.

• Follow the API provider's security requirements.

For operations that create payments, orders, or other important records, understand whether the API supports idempotency before automatically retrying a request after a timeout.

20. API Interview Questions: Quick Revision

What is an API?

An interface that allows software components to communicate through defined rules.

What is a REST API?

An API designed around REST architectural principles, commonly using HTTP methods and resource-oriented URLs.

What is an endpoint?

An address that identifies a resource or operation exposed by an API.

What is the difference between GET and POST?

GET generally retrieves a representation, while POST commonly submits data or initiates processing.

What is JSON?

A text-based format used to exchange structured data.

What is the difference between 401 and 403?

401 concerns authentication; 403 indicates that the requested operation is not permitted.

What is an API token?

A value used to authenticate or authorize requests, depending on the token design.

What is rate limiting?

A mechanism that restricts how frequently a client can make requests.

What is pagination?

A method for retrieving a large result set in smaller portions.

What is an API timeout?

A limit on how long a client waits for an operation or response.

What is an API response code?

An HTTP status code indicating the general outcome of a request.

What is API testing?

The process of verifying an API's behavior, responses, validation, and security.

21. API Quick Reference

Conclusion

APIs are a fundamental part of modern software and digital services. Understanding endpoints, HTTP methods, status codes, JSON, authentication, pagination, rate limits, and API testing will help you work with integrations more confidently.

Start by testing simple GET requests, examining JSON responses, and learning how request headers and parameters work. Then progress to authenticated APIs, POST requests, automated testing, and secure integration design.

Use this cheat sheet as a quick reference while learning API concepts and preparing for technology interviews.