The dirty secrets of building large HTTP APIs
summary
Concrete lessons and runnable tools: use JSON Schema validation to reject bad payloads and keep legacy quirks from propagating, auto‑generate docs from those schemas so docs stay accurate, sign self‑contained credentials with JWT scopes and support revocation by token id, enforce a token‑bucket rate limiting (example: per‑customer 10 req/s) and return limits in responses, run dual‑run Elasticsearch canaries for migrations, and implement cross‑cloud failover (AWS ↔ Azure) — these practices proved deployable and reduced live breakages.
AI-written summary · about
chapters (36)
- 0:00Intro
- 0:53Why is this talk important
- 2:05Developers
- 2:52Validation
- 3:20JSON Schemas
- 4:48Thinking about your audience
- 5:50HappyGS4 API
- 6:18Documentation
- 6:47API Explorer
- 8:21API Permissions
- 8:46Credentials
- 9:04Centralization
- 9:15Exploration Control
- 9:25JSON Web Tokens
- 11:10Authentication
- 11:22Scopes
- 11:42revoking credentials
- 12:21Badgers survey
- 12:35Stress tests
- 12:54Dependencies
- 13:23How do you do that
- 14:10Token Bucket Algorithm
- 14:36Bucket for Customers
- 14:56Feedback
- 15:30Bouncer
- 15:51G redundancy
- 16:15Data centers can fail
- 16:29Godzilla
- 17:38Monitoring
- 18:25Change
- 18:52Experience
- 19:10Feature Change
- 20:01Error Rates
- 20:44Shipping
- 21:19Change evolve
- 21:50Outro
related talks
21mThe Dirty Secrets of Building Large, Highly Available, Scalable HTTP APIs
35mPrinciples of Awesome APIs and How to Build Them
35mBroken APIs Break Trust: Tips for Creating and Updating APIs
41mThe making of a great API
24mDesigning the APIs for an Internal Set of Services
35mBuilding Your API for Longevity
28mA History Lesson in Painful Industry Mistakes
57mGive it a REST - Tips for designing and consuming public API's