Foreword |
|
xix | |
Preface |
|
xx | |
Acknowledgments |
|
xxii | |
About this book |
|
xxiii | |
About the authors |
|
xxvi | |
About the cover illustration |
|
xxvii | |
|
|
1 | (2) |
|
1 Introducing APIs and OpenAPI |
|
|
3 | (1) |
|
1.1 What is an API ecosystem? |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
4 | (1) |
|
The potential of Bridget's solution |
|
|
5 | (1) |
|
|
5 | (2) |
|
Example OpenAPI definition |
|
|
6 | (1) |
|
1.4 Where do OpenAPI definitions fit in? |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
11 | (2) |
|
2 Getting set up to make API requests |
|
|
13 | (13) |
|
|
14 | (1) |
|
|
14 | (1) |
|
The first two operations of the FarmStall API |
|
|
14 | (1) |
|
2.2 Getting set up with Postman |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (2) |
|
Forming a GET request in Postman |
|
|
17 | (1) |
|
|
18 | (1) |
|
2.5 Adding a review to the FarmStall API |
|
|
18 | (3) |
|
Forming a POST request in Postman |
|
|
19 | (2) |
|
|
21 | (1) |
|
|
21 | (2) |
|
Cat (and other animal) facts API |
|
|
21 | (1) |
|
|
22 | (1) |
|
DuckDuckGo's search engine API |
|
|
22 | (1) |
|
|
22 | (1) |
|
|
23 | (3) |
|
3 Our first taste of OpenAPI definitions |
|
|
26 | (9) |
|
|
28 | (1) |
|
3.2 Introducing the OpenAPI specification |
|
|
29 | (1) |
|
3.3 A quick refresher on YAML |
|
|
29 | (3) |
|
|
31 | (1) |
|
3.4 Describing our first operation |
|
|
32 | (1) |
|
3.5 Extending our first operation |
|
|
33 | (2) |
|
4 Using Swagger Editor to write OpenAPI definitions |
|
|
35 | (13) |
|
4.1 Introducing Swagger Editor |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (1) |
|
4.2 Writing the smallest OpenAPI definition in Swagger Editor |
|
|
38 | (3) |
|
The smallest valid OpenAPI definition |
|
|
38 | (1) |
|
Writing in Swagger Editor |
|
|
39 | (1) |
|
|
40 | (1) |
|
4.3 Adding GET /reviews to our definition |
|
|
41 | (1) |
|
4.4 Interacting with our API |
|
|
42 | (6) |
|
|
43 | (1) |
|
Adding servers to our definition |
|
|
44 | (1) |
|
Executing GET /reviews (again) |
|
|
45 | (3) |
|
5 Describing API responses |
|
|
48 | (16) |
|
|
49 | (1) |
|
|
50 | (1) |
|
5.3 The mind-blowing world of data schemas |
|
|
51 | (1) |
|
|
51 | (4) |
|
|
52 | (1) |
|
Adding a field to an object |
|
|
53 | (1) |
|
The minimum and maximum keywords |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
5.6 Media types (aka MIME) |
|
|
56 | (1) |
|
5.7 Describing the GET /reviews response |
|
|
57 | (7) |
|
Smallest response in OpenAPI |
|
|
57 | (143) |
|
The GET /reviews 200 Response Body |
|
|
57 | (1) |
|
Adding the rating field to our response body |
|
|
58 | (1) |
|
Describing message, uuid, and userld |
|
|
59 | (5) |
|
|
64 | (18) |
|
|
65 | (1) |
|
6.2 Describing POST /reviews with a request body |
|
|
66 | (5) |
|
Where to find request bodies |
|
|
69 | (1) |
|
Describing the schema for POST /reviews requestBody |
|
|
70 | (1) |
|
6.3 Executing operations with request bodies |
|
|
71 | (4) |
|
Adding examples to make try-it-out look pretty |
|
|
74 | (1) |
|
6.4 Describing GET /reviews/{reviewld} with a path parameter |
|
|
75 | (3) |
|
|
76 | (1) |
|
Describing the reviewldpath parameter |
|
|
77 | (1) |
|
6.5 Verifying our reviews are getting created |
|
|
78 | (4) |
|
7 Adding authentication and authorization |
|
|
82 | (17) |
|
|
84 | (1) |
|
7.2 Getting set up for authentication |
|
|
85 | (6) |
|
Challenge: Describe POST /users |
|
|
86 | (1) |
|
Challenge: Describe POST /tokens |
|
|
86 | (2) |
|
Solution: Definition changes |
|
|
88 | (1) |
|
Verifying we can create users and get a token |
|
|
89 | (2) |
|
7.3 Adding the Authorization header |
|
|
91 | (5) |
|
How OpenAPI handles authorization |
|
|
92 | (1) |
|
Types of authorization (securities) supported in OpenAPI 3.0.x |
|
|
92 | (1) |
|
Adding the Authorization header security scheme |
|
|
93 | (1) |
|
Adding the security requirements to POST/reviews |
|
|
94 | (1) |
|
Using the security feature of try-it-out |
|
|
94 | (2) |
|
|
96 | (1) |
|
7.5 Other types of security schemas |
|
|
97 | (1) |
|
7.6 How to add security schemes in general |
|
|
97 | (2) |
|
8 Preparing and hosting API documentation |
|
|
99 | (22) |
|
|
100 | (3) |
|
8.2 Adding metadata to the definition |
|
|
103 | (2) |
|
8.3 Writing the description in Markdown |
|
|
105 | (6) |
|
|
106 | (2) |
|
Adding a rich text description to the FarmStall API definition |
|
|
108 | (3) |
|
8.4 Organizing operations with tags |
|
|
111 | (3) |
|
Adding the Reviews tag to GET/reviews |
|
|
112 | (1) |
|
Adding descriptions to tags |
|
|
112 | (1) |
|
Adding the rest of the tags |
|
|
113 | (1) |
|
8.5 Hosting our API documentation using Netlify.com and Swagger UI |
|
|
114 | (6) |
|
Preparing Swagger UI with our definition |
|
|
115 | (1) |
|
|
116 | (4) |
|
|
120 | (1) |
|
|
121 | (116) |
|
9 Designing a web application |
|
|
123 | (19) |
|
|
124 | (1) |
|
9.2 PetSitter project kickoff |
|
|
124 | (4) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
127 | (1) |
|
9.3 Domain modeling and APIs |
|
|
128 | (3) |
|
|
130 | (1) |
|
Looking back on FarmStall |
|
|
130 | (1) |
|
9.4 A domain model for PetSitter |
|
|
131 | (3) |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
133 | (1) |
|
9.5 User stories for PetSitter |
|
|
134 | (8) |
|
|
134 | (1) |
|
|
134 | (2) |
|
|
136 | (6) |
|
10 Creating an API design using OpenAPI |
|
|
142 | (26) |
|
|
143 | (2) |
|
Converting a domain model to OpenAPI |
|
|
143 | (1) |
|
|
144 | (1) |
|
10.2 Creating the schemas |
|
|
145 | (7) |
|
Starting an OpenAPI file with schemas |
|
|
145 | (1) |
|
Referencing common schemas |
|
|
146 | (1) |
|
|
146 | (2) |
|
|
148 | (2) |
|
|
150 | (1) |
|
The Job Application schema |
|
|
151 | (1) |
|
10.3 The CRUD approach to API operations |
|
|
152 | (4) |
|
Defining API requests and responses |
|
|
154 | (2) |
|
From user stories to CRUD design |
|
|
156 | (1) |
|
10.4 API operations for PetSitter |
|
|
156 | (12) |
|
|
156 | (3) |
|
|
159 | (4) |
|
JobApplication operations |
|
|
163 | (5) |
|
11 Building a change workflow around API design-first |
|
|
168 | (14) |
|
|
169 | (2) |
|
11.2 Communicating and reacting to change |
|
|
171 | (1) |
|
11.3 GitHub as our workflow engine |
|
|
172 | (3) |
|
|
173 | (1) |
|
|
173 | (1) |
|
|
173 | (1) |
|
A way of viewing changes (based on an older version) |
|
|
174 | (1) |
|
11.4 Tying the GitHub workflow together |
|
|
175 | (2) |
|
Setting up GitHub and the source of truth |
|
|
175 | (1) |
|
Steps in our GitHub workflow |
|
|
176 | (1) |
|
11.5 A practical look at the workflow |
|
|
177 | (5) |
|
Creating and suggesting DELETE /jobs/{id} |
|
|
177 | (1) |
|
Reviewing and accepting changes |
|
|
178 | (1) |
|
Comparing older branches to the latest |
|
|
179 | (1) |
|
|
180 | (2) |
|
12 Implementing frontend code and reacting to changes |
|
|
182 | (16) |
|
|
183 | (1) |
|
|
183 | (2) |
|
|
183 | (1) |
|
Verifying that Prism works |
|
|
184 | (1) |
|
12.3 Building a frontend based on a mock server |
|
|
185 | (4) |
|
Adding multiple examples into your OpenAPI definition |
|
|
187 | (1) |
|
|
188 | (1) |
|
12.4 Identifying a missing API operation |
|
|
189 | (9) |
|
Due diligence for adding the operation |
|
|
190 | (1) |
|
Designing the new operation |
|
|
190 | (3) |
|
Choosing which mock data response to get from Prism |
|
|
193 | (2) |
|
Formalizing and suggesting the change |
|
|
195 | (1) |
|
|
196 | (2) |
|
13 Building a backend with Node.js and Swagger Codegen |
|
|
198 | (23) |
|
|
199 | (1) |
|
13.2 Introducing Swagger Codegen |
|
|
199 | (2) |
|
|
200 | (1) |
|
|
200 | (1) |
|
|
200 | (1) |
|
13.3 The backend structure |
|
|
201 | (3) |
|
|
201 | (1) |
|
Investigating the structure |
|
|
201 | (2) |
|
|
203 | (1) |
|
13.4 Updating OpenAPI for the backend |
|
|
204 | (5) |
|
|
204 | (2) |
|
|
206 | (2) |
|
Regenerating the backend stubs |
|
|
208 | (1) |
|
13.5 Running and testing the backend |
|
|
209 | (3) |
|
|
209 | (1) |
|
|
210 | (1) |
|
Output validation with Prism |
|
|
211 | (1) |
|
13.6 Database persistence with Mongoose |
|
|
212 | (6) |
|
|
213 | (1) |
|
Getting ready to use MongoDB |
|
|
214 | (1) |
|
Configuring Mongoose in the project |
|
|
214 | (1) |
|
|
214 | (4) |
|
13.7 Implementing API methods |
|
|
218 | (3) |
|
14 Integrating and releasing the web application |
|
|
221 | (16) |
|
|
222 | (3) |
|
|
222 | (1) |
|
|
223 | (1) |
|
|
224 | (1) |
|
14.2 Implementing authorization |
|
|
225 | (6) |
|
Creating a security scheme |
|
|
225 | (1) |
|
|
226 | (3) |
|
Defining operation security |
|
|
229 | (2) |
|
14.3 Managing repositories |
|
|
231 | (1) |
|
Keeping the existing structure |
|
|
231 | (1) |
|
Creating a shared Git repository to implement both components |
|
|
231 | (1) |
|
Combining code and API definition in a repository |
|
|
231 | (1) |
|
Making the choice and refactoring |
|
|
232 | (1) |
|
14.4 Setting up an integrated web server |
|
|
232 | (5) |
|
|
232 | (2) |
|
|
234 | (3) |
|
|
237 | (146) |
|
15 Designing the next API iteration |
|
|
239 | (14) |
|
15.1 Reviewing the first development sprint |
|
|
240 | (1) |
|
15.2 Planning the next sprint |
|
|
241 | (1) |
|
15.3 Preparing for new features |
|
|
242 | (6) |
|
Reviewing the domain model |
|
|
243 | (2) |
|
|
245 | (3) |
|
15.4 Improving the developer experience |
|
|
248 | (5) |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
250 | (1) |
|
Versioning vs. evolvability |
|
|
251 | (2) |
|
16 Designing schemas with composition in OpenAPI |
|
|
253 | (20) |
|
|
254 | (3) |
|
16.2 Polymorphism and inheritance in domain models |
|
|
257 | (2) |
|
16.3 Updating the schemas |
|
|
259 | (3) |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
262 | (1) |
|
16.4 Polymorphism and inheritance in OpenAPI |
|
|
262 | (6) |
|
Composition inside the Dog and Cat schemas |
|
|
264 | (2) |
|
Composition inside the Pet schema |
|
|
266 | (2) |
|
16.5 Adding discriminators in OpenAPI |
|
|
268 | (5) |
|
17 Scaling collection endpoints with filters and pagination |
|
|
273 | (31) |
|
|
274 | (2) |
|
|
276 | (6) |
|
|
277 | (1) |
|
|
277 | (3) |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
281 | (1) |
|
17.3 Filters for PetSitter |
|
|
282 | (8) |
|
|
282 | (4) |
|
Adding filters to OpenAPI |
|
|
286 | (4) |
|
|
290 | (1) |
|
17.4 Designing pagination |
|
|
290 | (4) |
|
Offset-based and page-based pagination |
|
|
291 | (2) |
|
|
293 | (1) |
|
17.5 Pagination for PetSitter |
|
|
294 | (3) |
|
Adding pagination to OpenAPI |
|
|
295 | (2) |
|
Extending our request example |
|
|
297 | (1) |
|
|
297 | (3) |
|
|
298 | (1) |
|
|
299 | (1) |
|
Consistency throughout parameter types |
|
|
299 | (1) |
|
17.7 Sorting for PetSitter |
|
|
300 | (4) |
|
|
300 | (1) |
|
Designing the sort parameter |
|
|
301 | (1) |
|
Adding sorting to OpenAPI |
|
|
301 | (1) |
|
The final request example |
|
|
302 | (2) |
|
18 Supporting the unhappy path: Error handling with problem+json |
|
|
304 | (20) |
|
|
305 | (1) |
|
|
306 | (3) |
|
|
307 | (2) |
|
|
309 | (1) |
|
18.3 Requirements for error responses |
|
|
309 | (3) |
|
18.4 The OAS tools format |
|
|
312 | (2) |
|
18.5 The problem+json format |
|
|
314 | (2) |
|
18.6 Adding error responses to OpenAPI |
|
|
316 | (4) |
|
|
317 | (1) |
|
Adding errors to operations |
|
|
318 | (2) |
|
18.7 Error-handling guidance |
|
|
320 | (4) |
|
|
320 | (2) |
|
|
322 | (2) |
|
19 Improving input validation with advanced JSON Schema |
|
|
324 | (29) |
|
|
325 | (1) |
|
19.2 Supported validations |
|
|
326 | (6) |
|
Read-only and write-only properties |
|
|
326 | (2) |
|
Enforcing number constraints |
|
|
328 | (1) |
|
|
328 | (2) |
|
Enforcing array constraints |
|
|
330 | (1) |
|
|
331 | (1) |
|
Listing required and optional properties |
|
|
331 | (1) |
|
|
332 | (1) |
|
19.3 Updating PetSitter schemas |
|
|
332 | (8) |
|
|
333 | (2) |
|
|
335 | (1) |
|
|
336 | (1) |
|
Pet, Dog, and Cat schemas |
|
|
337 | (2) |
|
Versioning an API and handling breaking changes |
|
|
339 | (1) |
|
|
340 | (1) |
|
20.2 What is a breaking change? |
|
|
341 | (1) |
|
20.3 Releasing a breaking change |
|
|
341 | (12) |
|
Coordinated breaking changes |
|
|
342 | (1) |
|
|
343 | (3) |
|
Using media types to version operations |
|
|
346 | (3) |
|
Adding and deprecating features |
|
|
349 | (4) |
|
21 The API prerelease checklist |
|
|
353 | (30) |
|
21.1 Pros and cons of a public API |
|
|
353 | (1) |
|
|
354 | (2) |
|
21.3 Getting the API working |
|
|
356 | (4) |
|
|
356 | (1) |
|
|
357 | (3) |
|
|
360 | (2) |
|
21.5 Getting your API consistent |
|
|
362 | (1) |
|
21.6 Validation and error reporting |
|
|
363 | (1) |
|
21.7 An API roadmap and exposure index |
|
|
363 | (3) |
|
21.8 Getting a change strategy |
|
|
366 | (1) |
|
|
366 | (2) |
|
21.10 Monitoring your API |
|
|
368 | (1) |
|
Setting up metric collection |
|
|
368 | (1) |
|
|
369 | (14) |
|
Appendix Swagger 2.0, OpenAPI 3.0, and OpenAPI 3.1 |
|
|
371 | (12) |
Index |
|
383 | |