API
12 packages, each available for 11 model families.
api-security
Securing an HTTP API — authentication at the edge, per-object authorization, input validation, transport, and the controls that stop the OWASP API…
filtering
Filter parameters that are expressive without being injectable — allowlisted fields, typed operators, index-backed queries, and bounded cost.
graphql
GraphQL schema and server rules — bounding query cost, killing N+1 with dataloaders, per-field authorization, and errors clients can act on.
open-api
OpenAPI specifications that stay true — generating from code, gating breaking changes in CI, and producing docs and SDKs from one source.
pagination
Cursor and offset pagination — which to use, how to encode a cursor, and why deep OFFSET pages get slower and skip rows.
rate-limiting
Rate limiting that protects the service without punishing legitimate clients — algorithm choice, key selection, headers, and distributed enforcement.
rest
Designing HTTP APIs that clients can rely on — resource modelling, correct status codes, idempotency, and the conventions that prevent breaking…
rpc
gRPC and typed RPC — protobuf evolution rules, deadlines and cancellation, streaming, error models, and when RPC beats REST.
sdk
Publishing client SDKs that stay correct — generation from the spec, retries and idempotency, typed errors, versioning, and release automation.
sorting
Sort parameters that are stable, indexed and injection-proof — allowlisted keys, deterministic tiebreakers, null ordering, and locale-aware text.
versioning
Versioning an HTTP API without stranding clients — what counts as breaking, where the version lives, and how to deprecate on a schedule people can…
webhooks
Sending and receiving webhooks reliably — HMAC signatures, replay protection, at-least-once delivery, retries with backoff, and idempotent consumers.