Authoritative Sources
The definitions, status-code semantics, and design practices in this pack are grounded in the following primary standards and widely recognised references. Where a concept has a canonical specification (for example HTTP semantics or Problem Details), the maintained IETF document is cited.
HTTP and Core Web Standards (IETF)
- HTTP Semantics - RFC 9110 (methods, idempotency, status codes, conditional requests), IETF. https://www.rfc-editor.org/rfc/rfc9110.html
- HTTP Caching - RFC 9111, IETF. https://www.rfc-editor.org/rfc/rfc9111.html
- Problem Details for HTTP APIs - RFC 9457 (obsoletes RFC 7807), IETF. https://www.rfc-editor.org/rfc/rfc9457.html
- RateLimit header fields for HTTP - IETF draft (httpapi WG). https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
- The Sunset HTTP Header Field - RFC 8594, IETF. https://www.rfc-editor.org/rfc/rfc8594.html
- The Deprecation HTTP Header Field - RFC 9745, IETF. https://www.rfc-editor.org/rfc/rfc9745.html
Authentication and Authorization
- The OAuth 2.0 Authorization Framework - RFC 6749, IETF. https://www.rfc-editor.org/rfc/rfc6749.html
- Proof Key for Code Exchange (PKCE) - RFC 7636, IETF. https://www.rfc-editor.org/rfc/rfc7636.html
- JSON Web Token (JWT) - RFC 7519, IETF. https://www.rfc-editor.org/rfc/rfc7519.html
- OpenID Connect Core 1.0 - OpenID Foundation. https://openid.net/specs/openid-connect-core-1_0.html
Update and Patch Formats
- JSON Merge Patch - RFC 7386, IETF. https://www.rfc-editor.org/rfc/rfc7386.html
- JSON Patch - RFC 6902, IETF. https://www.rfc-editor.org/rfc/rfc6902.html
API Description and Style
- OpenAPI Specification - OpenAPI Initiative (Linux Foundation). https://spec.openapis.org/oas/latest.html
- Architectural Styles and the Design of Network-based Software Architectures (REST) - Roy T. Fielding, dissertation. https://ics.uci.edu/~fielding/pubs/dissertation/top.htm
- JSON:API Specification. https://jsonapi.org/format/
- Microsoft REST API Guidelines. https://github.com/microsoft/api-guidelines/blob/vNext/Guidelines.md
- Google API Improvement Proposals (AIP). https://google.aip.dev/
Web Platform and Security
- CORS - MDN Web Docs (Mozilla). https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- HTTP response status codes - MDN Web Docs (Mozilla). https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
- OWASP API Security Top 10. https://owasp.org/API-Security/editions/2023/en/0x00-header/
- Richardson Maturity Model - Martin Fowler. https://martinfowler.com/articles/richardsonMaturityModel.html
RPC and Schema
- gRPC Documentation. https://grpc.io/docs/
- GraphQL Specification. https://spec.graphql.org/
- Semantic Versioning 2.0.0. https://semver.org/