REST API cheat sheet

Methods, headers, auth and the design rules you assert against.

Methods

GET

Safe and idempotent

GET /users?page=2

POST

Creates, not idempotent

POST /users

PUT vs PATCH

Both idempotent when designed correctly

PUT = full replace, PATCH = partial update

DELETE

Idempotent — repeat returns 404 or 204

DELETE /users/42

Content type

Content-Type: application/json

Bearer token

Authorization: Bearer <jwt>

API key

x-api-key: <key>

Idempotency

Common on payment APIs

Idempotency-Key: <uuid>

Status + schema

expect(res.status).toBe(201); validate(res.body, schema);

Negative cases

missing field → 400, bad token → 401, wrong owner → 403

Book a free demo class and apply these commands on live project work.