Als jullie een API bouwen, beginnen jullie dan met het definiëren van een openapi.yaml (Open API Spec, kortweg OAS) of start je direct met programmeren?

Dat laatste is natuurlijk aantrekkelijk, maar niet altijd slim. Hoe je OAS-first werkt vind je in ons artikel van collega @dvh:

https://developer.overheid.nl/kennisbank/apis/aan-de-slag/bouw-een-api

If You’re Not Threat Modeling, Your API Is Already Vulnerable - DevX https://buff.ly/uqPiDEb

"if you care about uptime, user trust, or your job, you need to know where your API’s soft spots are. Otherwise, attackers will find them for you."

Handy API Extension Patterns https://leanpub.com/api-extension-patterns

"Starting with a clear look at strong, weak, and "mild" typing styles, the book introduces a resilient approach using structured extensions and runtime accessors that allow APIs to grow gracefully over time."

APIs Over IPAs 17: Aligning API Design to Business Outcomes with James Higginbotham, LaunchAny https://buff.ly/RIMPEex

"In this episode, Derric Gilling chats with James Higginbotham, founder of LaunchAny, about designing successful API strategies that drive business value. "

A Heads-Up: Some Older Posts Will Be Moving Behind the Paywall https://buff.ly/kPkqfZX

"Hey folks — just a quick note. Over the next few weeks, I’ll be moving some older posts behind the paywall. " -- #MikeAmundsen

API caching can save servers some serious work, cut down on costs, and even help reduce the carbon impact of an API. However, it is often considered an optimization rather than what it truly is: an integral part of API design. #ApiDesign #GreenTech https://apisyouwonthate.com/blog/api-design-basics-cacheability/

Medior PHP https://leanpub.com/b/mediorphp by Joseph Kanyo is the featured bundle of ebooks on the Leanpub homepage! https://leanpub.com #Php #Databases #Mysql #ComputerProgramming #Laravel #Symfony #Html #Refactoring #Apis #ApiDesign #books #ebooks

Four AI Superpowers: Where AI Improves Products https://buff.ly/GxlcQZu

"When using AI consider its four "superpowers": content creation, summarization, basic data analysis, and perspective taking."

"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.

Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.

There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.

Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.

Best Practices
Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."

https://nordicapis.com/9-signs-youre-doing-api-security-wrong/

Spec-First or Code-First? Choosing Your OpenAPI Strategy with Quarkus vs. Spring https://myfear.substack.com/p/spec-first-or-code-first-choosing
#Java #Quarkus #APIDesign #OpenAPI

"The accompanying diagram is intended to help you quickly decide how to document an API, but particularly a REST API. The first split is just to make sure you are looking for the right kind of API.

Here is some more context to help you decide on an approach and get started."

https://gist.github.com/briandominick/3ffab6be460fbde799aa34e0a42a4299

Why Every Product Manager Must Master APIs??

https://buff.ly/42BY0VD

"I realized APIs are not just technical specs; they are full-fledged products, and designing them right is a strategic superpower."

The Information Architecture Philosophy Behind RESTful Web API Patterns and Practices Cookbook https://buff.ly/97cOvn8

I’m so excited that this book is back on track!

Build APIs You Wont Hate 2: This Time Its Serious

Roughly 80% of the internet is roughly built APIs, held together with enough duct-tape to choke all the hamsters powering it. Let's learn how to build them properly.

#apidesign
#apidevelopment

https://leanpub.com/build-apis-you-wont-hate-2

"Affordance Aversion" : The bias that makes devs resist declarative, dynamic API models (like ALPS) in favor of rigid schemas and static interfaces.

Loss Aversion + Endowment Effect = Overvaluing predictability, fearing flexibility.

Want resilient APIs? Rethink the trade-offs.

"Getting to this point isn’t unusual. Clients clearly think they’re making the call correctly, or else they would fix the endpoint themselves. Some misspellings are difficult to catch. The enum USER_RETREIVE may not be noticed from USER_RETRIEVE, especially if picking it from a list. Misspellings happen and they’re not always caught before making it to the contract. As an aside, that’s why it’s important writers routinely check development’s changes. This applies, too, to our testing calls in Postman, where manually entering endpoints and values are more pervasive.

The reason this isn’t caught is simple: We’re not expecting it.

For our testing, the call is made and we get results. We may even spot check some of them. But generally, results aren’t examined that closely. For instance, how often do you so carefully examine a returned list of 50 or 100 items? You check may check that the objects are complete but not that the list conforms to the search criteria.

The reason this happens is because of an intentional behavior on the server. This behavior is called Lenient Handling or Strict Handling."

https://robertdelwood.medium.com/understanding-query-parameter-handling-in-rest-calls-1821e0c3fa8c

Just wrote about API versioning strategies for your developer platform! From Semantic Versioning to different implementation approaches (URI, header-based, and query parameters), I break down the pros and cons of each method based on real-world experience.

#APIDesign #DeveloperExperience #SoftwareEngineering #API

Read more about crafting a robust API versioning strategy that works for both your team and third-party developers: https://tmaguire.net/blog/2025/02/25/api-versioning.html?utm_source=LinkedIn&utm_medium=social&utm_campaign=blog_promotion

I’ve written a guide on API Design for Speakeasy which is almost everything I know about designing an API from scratch. Basic theory of everything, pros and cons of various standards, pitfalls to watch out for, and best practices to stick to. Give me feedback and I’ll improve it. What’s missing. What could I add. Not done yet! #ApiDesign https://www.speakeasy.com/api-design

2024 State of the API Report

https://www.postman.com/state-of-api/2024/

"2024 marks the 6th year of the State of the API—the most comprehensive survey on APIs with over 5,600 developers and API professionals sharing their thoughts this year." -- #postmanm

last call!

in co-operation with #OpenAPI, #apiMasters, and #apiDays, I'll be presenting a one-day "Designing APIs with OpenAPI" workshop in Paris Dec-02.

here's a 20%-off coupon for the few seats still available.
https://ticket.apidays.global/event/apidays-paris-2024-masterclasses/6ffe1239-bde7-44c7-92d0-5816518683f6/cart?coupon=MIKECOUPON20

hope to see you there!