##Summary
Representational State Transfer (REST) is a software architecture style that relies on a stateless, client-server, cacheable communications protocol. The idea is that client-server is separated for portability of code and ability to scale web services. REST basically exposes application data through an API and with a web framework like django, it’s easy to use django-rest-framework to implement a RESTful API.
##HTTP Messages
HTTP messages are made up of a header and optionally a body. Messages can be either a:
HTTP messages are made up of a header and body.
####HTTP Message Header
HTTP Header contains metadata and can only contain plain text formatted in a specific manner. These include:
####HTTP Message Body (optional)
HTTP body can contain any data in any format. You can send plain text, HTML, XML, etc. By requesting different metadata or URLs, you can choose between different representations for the same resource (e.g. send webpage to browsers, JSON to applications).
####HTTP Response
HTTP Response should specify the content type of the body using the Content-Type field. For example: Content/Type: application/json.
##Commands
REST systems communicate over Hypertext Transfer Protocol (https) and uses the following commands to retrieve and send data.
SELECT in SQL. This is a ‘SAFE’ method (along with HEAD, OPTIONS) while the others below are considered ‘UNSAFE’ (may modify resource).INSERT in SQLUPDATE in SQLUPDATE in SQLDELETE in SQL* instead of say resource id 2)##Important HTTP Status Codes
####Sample API URLs
####Example API Commands
A common HTTP library is cURL. Assumming a local dev server running at http://127.0.0.1:8000, here are some sample commands.
curl -v http://127.0.0.1:8000/api/v1/experiences/curl -v -X DELETE http://127.0.0.1:8000/api/v1/experiences/2/curl -v -X POST http://127.0.0.1:8000/api/v1/experiences/ --data "title=mytitle"http -a will@jobwaffle.com:test POST http://127.0.0.1:8000/api/v1/experiences/ title='jobtitle' q_like_dislike='stuff'####Rate limiting
It is standard practice to rate limit access to an API. At a minimum, include these headers.
X-Rate-Limit-Limit - the number of allowed requests in the current periodX-Rate-Limit-Remaining - the number of remaining requests in the current periodX-Rate-Limit-Reset - the number of seconds left in the current period. Note: do not use a UNIX timestamp (seconds since epoch) for this field.####Considerations when making a RESTful API
/api/v1/ instead of just /api/{'resume': 'will', education: [1, 2, 3]} should be {'resume': 'will', education: [ 'api/v1/education/1', 'api/v1/education/2', 'api/v1/education/3' ]}?format=JSON, ?format=XML allows you to specify the format; the output format should be determined from the HTTP ‘Accept’ header##Authentication
Authentication is determining who the user is (Note: This is different than Permissions, which checks if the credentials has the permission to allow or disallow an action). If you’re implementing a server side authentication using an API, you can do a Cookie-Based Authentication (that uses server side cookies to authenticate the user on every request) or a Token-Based Authentication (that rlies on a signed token that is sent to the server on each request).
Token Benefits
Tokens are stateless (i.e. helps with server side scalability) so don’t require a session store, the token is a self-contained entity that has all the user information.
With Tokens, you can have your server as just an API while the rest of your assests (the HTML, images, javascript, etc) can be served from a CDN.
##Django REST Framework
Authentication is how we check who the user is (normally by username, password, or some type of session or token). E.g. BasicAuthentication, SessionAuthentication, TokenAuthentication. If no authentication is specified, we get a request.user is set to an instance of django.contrib.auth.models.AnonymousUser and request.auth is set to None.
Permission is what we check to see if the logged in user should be allowed or disallowed to do an action. E.g. IsOwnerOrReadOnly, IsAuthenticatedOrReadOnly
ViewSet is a single class that lets you combine the logic of a set of related views. In other REST Frameworks, this might be called ‘Resources’ or ‘Controllers’.
ViewSet is a class-based view that does not provide implementation of actions like .get() or .post() and instead provides actions like .list(), .create(), .retrieve(), .update(), .partial_update(), and .destroy().GenericViewSet inherits from GenericAPIView and provides default set of get_object, get_queryset methods, but also does not provide actions by default.ModelViewSet inherits from GenericAPIView and provides actions like .list(), .retrieve(), .create(), .update(), and .destroy(). You only need to provide the queryset and serializer_class attributes.ModelViewSet takes your existing base class and provides some default behavior, like a set of views specifically for listing, creating, retrieving, and destroying objects of a Model.