Best practices we should follow when we create API.

Best practices we should follow when we create API.

Create API for dedicated back end service. For each of the resources the HTTP methods used to perform the required application functions have to be decided. This includes the use of applicable HTTP headers.

Special behavior required by the application (e.g. concurrency control, long running requests) has to be decided.

Finally, potential error situations have to be identified and corresponding error messages have to be designed.

Proper Naming

It's important to have proper name for service and service paths. For example when we create some API related to camera related operations we can name API and resources with camera specific terms. For example we can name API as camera-api. Then when we create new resource we can create resource like capture-image, delete-image etc.

Resources must be named properly by means of URIs (Uniform Resource Identifiers). Proper naming of resources is key for an API to be easily understandable by clients.

Following are some of the guidelines for design proper API/Resource paths and names. These are not mandatory rules but whenever possible we should these best practices.

Atomic resources, collection resources and composite resources should be named as nouns because they represent "things", not "actions" (actions would lean more towards verbs as names of resources).

• Processing function resources and controller resources should be named as verbs because they in fact represent "actions".
• Processing function resources and controller resources should not be sub-resources of individual other resources.
• Lower case characters should be used in names only because the rules about which URI element names are case sensitive and which are not may cause confusion.
• If multiple words are used to name a resource, these words should be separated by dashes (i.e. "-") or some other separator.
• Singular nouns should be used for naming atomic resources.
• Names of collections should be "pluralized", i.e. named by the plural noun of the grouped concept (atomic resource or composite resource).
• Use forward slashes (i.e. "/") to specify hierarchical relations between resources. A forward slash will separate the names of the hierarchically structured resources. The parent name will immediately precede the name of its immediate children.

Proper Versioning

The version of an API is specified as part of its URI. Usually this version is specified as a pair of integers (separated by a dot) referred to as the major and the minor number of the version, preceded by the lowercase letter "v". E.g. a valid version string in the base path would be v2.1 indicating the first minor version of the second major version of the corresponding API.

Proper versioning strategy for API will helpful for all API users and client to communicate with API easily and effectively. In WSO2 API Manager we do have API versioning support. Also we can copy existing API and create new version of same API. When you need to create new version of running API recommended approach is create new version from existing API API and modify it. Then before we publish new version we need to test all the functionalities of this API.

Following are some of the guidelines we need to follow when we version APIs. Again these are not mandatory rules. But it's good to follow these rules whenever possible.

In general, a version number following the semantic versioning concept has the structure major.minor.patch and the significance in terms of client impact is increasing from left to right:

• An incremental patch number means that the underlying modification to the API cannot even be noticed by a client - thus, the patch number is omitted from the version string. Only the internal implementation of the API has been changed while the signature of the API is unchanged. From the perspective of the API developer, a new patch number indicates a bug fix, a minor internal modification, etc.
• An incremented minor number indicates that new features have been added to the API, but this addition must be backward compatible: the client can use the old API without failing. For example, the API may add new optional parameters or a completely new request.
• An incremented major number signals changes that are not backward compatible: for example, new mandatory parameters have been added, former parameters have been dropped, or complete former requests are no longer available.

It is best practice to support the current major version as well as at least one major version back. In case new versions are released frequently (e.g. every few months) more major versions back have to be supported. Otherwise, clients will break (too fast).

Use of Proper HTTP Methods

Manipulation of resources in the REST style is done by create, retrieve, update, and delete operations (so-called CRUD operations), that map to the HTTP methods POST, GET, PUT, PATCH and DELETE.

A request that can be used without producing any side-effect is called a safe request. A request that can be used multiple times and that is always producing the same effect as the first invocation is called idempotent.

Get

GET is in HTTP as well as in the REST style specified as a safe and idempotent request. Thus, an API using the GET method must not produce any side-effects. Retrieving an atomic resource  or a composite resource is done by performing a GET on the URI identifying the resource to be retrieved.

Put

PUT substitutes the resource identified by the URI. Thus, the body of the corresponding PUT message provides the modified but complete representation of a resource that will completely substitute the existing resource: parts of the resource that have not changed must be included in the modified resource of the message body. Especially, a PUT request must not be used for a partial update.

Post

POST is neither safe nor idempotent. The main usages of POST are the creation of new resource, and the initiation of functions, i.e. to interact with processing function resources as well as controller resources.

In order to create a new resource, a POST request is used with the URI of the collection resource to which the new resource should be added.

Delete

A resource is deleted by means of the DELETE request on the URI of the resource. Once a DELETE request returned successfully with a "200 OK" response, following DELETE requests on the same URI will result in a "404 Not Found" response because there is no resource available with the URI of the deleted resource.

Patch

Usually HTTP Patch request will use to do partial update on resources. For example if you do not change entire resource and just changes some of the attributes you can use patch method. Unlike Put method we can use this for partial update for resources.

How WSO2 API Manager timeouts and suspension works

Address and WSDL endpoints can be suspended if they are detected as failed endpoints. When an endpoint is in in suspended state for a specified time duration following a failure, it cannot process any new messages. Please find the WSO2 ESB document[1] which explains those properties and their usage(even APIM and ESB are different products they do share same synapse runtime and these properties will effect in same manner).

errorCode - A comma separated error code list which can be returned by the endpoint.This parameter is used to specify one or more error codes which can cause the endpoint to be suspended when they are returned from the endpoint. Multiple error codes can be specified, separated by commas.

initialDuration - The number of milliseconds after which the endpoint should be suspended when it is being suspended for the first time.

maximumDuration -The maximum duration (in milliseconds) to suspend the endpoint.

progressionFactor  - The progression factor for the geometric series. See the above formula for a more detailed description.

When endpoint suspension happens, it will work as follows.
For the suspend duration after the first failure, this equation does not applies. Also when endpoint changed from active to suspend state, suspension duration will be exactly initial duration.
This equation only applies when endpoint already in suspended state and suspension duration expired.

next suspension time period = Min (Initial suspension duration * Progression Factor , Max suspend time).

[1]https://docs.wso2.com/display/ESB481/Address+Endpoint

Also in API Manager we do have different timeouts. So if some endpoint timed out then we will notice that as faulty endpoint and consider for suspension

1. Global timeout defined in synapse.properties (API_HOME\repository\conf) file. This will decide the maximum time that a callback is waiting in the APIM for a response for a particular request. If APIM does not get any response from Back End, it will drop the message and clears out the callback. This is a global level parameter which affects all the endpoints configured in APIM.
The default is 120000 milliseconds (2 minutes).

2. Socket timeout defined in the passthru-http.properties (APIM_HOME\repository\conf) file. This parameter will decide on the timeout which a particular http request is waiting for a response. If APIM does not receive any response from the Back End during this period, HTTP connection get timed out and that will eventually throw timeout error in the APIM side and fault handlers will be hit.
The default value is 60000 milliseconds (1 minute).

3. You can define timeouts on the endpoint configuration such that it will affect only that particular endpoint in an API. This will be a better option if you need to configure timeouts per API endpoint for different Backend services. You can also define the action upon the timeout.
Below example configuration will set the endpoint to timeout in 120000 milliseconds (2 minutes) and then execute the fault handler.