REST APIs Cheatsheet

Updated September 2026 · Quick reference

REST-style APIs model resources with URLs and use standard HTTP methods to read and change them.

Return honest status codes, keep JSON shapes stable, and protect endpoints with HTTPS plus keys or Bearer tokens.

HTTP basics

Methods

GET read, POST create/action, PUT replace, PATCH partial update, DELETE remove.

GET /api/books/42
POST /api/books
PATCH /api/books/42
DELETE /api/books/42

Resource URLs

Nouns in the path; query strings for filters.

GET /api/books?author=Ada&sort=year
GET /api/books/42/reviews

Status codes

2xx success, 4xx client error, 5xx server error.

200 OK | 201 Created | 204 No Content
400 401 403 404 409 422
500 502 503

Idempotency

GET/PUT/DELETE should be safe to retry; POST often needs an Idempotency-Key.

Idempotency-Key: 7f3c2a...

JSON & headers

JSON body

Declare Content-Type: application/json.

{
  "title": "Practical APIs",
  "year": 2026
}

Common headers

Authorization, Content-Type, Accept, Location, Cache-Control.

Authorization: Bearer TOKEN
Content-Type: application/json
Accept: application/json

Error body

Stable machine code plus a human message.

{
  "error": "validation_failed",
  "message": "year must be an integer"
}

Created response

201 with Location pointing at the new resource.

HTTP/1.1 201 Created
Location: /api/books/42

Auth & design

API key

Prefer a header over a query string so keys leak less often.

X-API-Key: YOUR_KEY

Bearer token

OAuth2-style access tokens in Authorization.

Authorization: Bearer eyJhbGciOi...

Pagination

limit/offset or opaque cursors—never unbounded lists.

GET /api/books?limit=20&offset=40

Versioning

Put breaking changes behind a new version path.

GET /api/v1/books
GET /api/v2/books

curl & OpenAPI

GET with curl

Include response headers while learning.

curl -i https://httpbin.org/get

POST JSON

Send a body and content type.

curl -i https://httpbin.org/post \
  -H "Content-Type: application/json" \
  -d '{"title":"Practical APIs"}'

Auth header

Match what your client will send.

curl -i https://api.example.com/v1/books \
  -H "Authorization: Bearer TOKEN"

OpenAPI peek

Describe paths and responses in YAML for docs and codegen.

openapi: 3.0.3
info:
  title: Books API
  version: 1.0.0
paths:
  /books:
    get:
      summary: List books

Comments

One comment per signed-in account. Comments are saved with this page’s URL.