Free REST API Design Patterns Cheat Sheet Online — 120+ API Architecture Best Practices & Design Reference
Master REST API design with our free interactive cheat sheet. 120+ patterns across 10 categories: Resource Naming & URL Design (plural nouns, kebab-case, max 3-level nesting, versioning in path/header, filtering query params, pagination params, sorting with -field, sparse fieldsets, search endpoints, sub-resources, trailing slash policy), HTTP Methods & Semantics (GET safe+idempotent, POST create with 201+Location, PUT full replacement, PATCH partial update with JSON Merge Patch RFC 7396 / JSON Patch RFC 6902, DELETE idempotent, HEAD metadata, OPTIONS CORS preflight, idempotency keys for at-most-once, POST vs PUT for creation, bulk operations, upsert with If-None-Match, method safety matrix), Request & Response Formats (JSON envelope {data,meta,errors}, paginated response, RFC 7807 Problem Details error format, HAL hypermedia with _links/_embedded, JSON:API compound documents, Siren actions+entities, Collection+JSON templates, ISO 8601 dates, binary responses with presigned URLs, content negotiation Accept header, gzip/brotli/zstd compression, JSONPath partial responses), Status Code Usage (200 OK, 201 Created+Location, 202 Accepted async, 204 No Content, 301 vs 308 redirects, 400 syntax errors, 401 vs 403 auth vs authZ, 404 not found, 409 conflict optimistic concurrency, 422 validation errors, 429 rate limiting with Retry-After, 500 with request IDs), Authentication & Authorization (Bearer tokens, API keys X-API-Key, OAuth 2.0 with PKCE, JWT structure iss/sub/exp/iat/scope, HMAC signing, httpOnly Secure SameSite cookies, CORS configuration, scope-based access, RBAC roles, API gateway auth, rate limit headers X-RateLimit-*, token refresh rotation), Pagination Filtering & Sorting (offset pagination, cursor pagination, keyset pagination, page-based pagination, Link header pagination RFC 5988, filter operators [gte]/[lt]/[in]/[like], sort convention, sparse fieldsets, full-text search /search, date range filtering, related resource inclusion ?include=, total count strategies), Error Handling (RFC 7807 Problem Details, consistent error schema, machine-readable error codes, validation error details per-field, stack trace policy dev vs prod, correlation IDs X-Request-ID, Retry-After backoff+jitter, user-facing actionable messages, i18n error messages, error documentation, monitoring 5xx rate alerts), Versioning (URL path /v1/, Accept header versioning, query param ?version=, custom header date-based like Stripe, no-versioning evolution, Sunset header RFC 8594, Deprecation header, version lifecycle Current→Deprecated→Retired, breaking change policy, API changelog, backwards compat testing, versioned docs /docs/v1), Performance & Caching (ETag/If-None-Match 304, Cache-Control private/public/s-maxage, conditional requests If-Match/If-None-Match, gzip/brotli compression, response streaming chunked/SSE, connection pooling keep-alive, batch/bulk endpoints, sparse fieldsets 96% reduction, 202 async pattern, webhook callbacks, CDN cache+purge, database query optimization N+1 prevention), Security (HTTPS everywhere HSTS, input validation allowlist, output encoding JSON, CORS exact origins, CSP headers, token bucket rate limiting, request size limits 413, SQL injection parameterized queries, secrets management rotation, audit logging immutable, API key rotation 24h grace, security headers checklist). The Cartographer's Atlas aesthetic — antique parchment background #1a1410 with lat/long grid overlay, compass rose decorative element, IM Fell English SC and Courier Prime fonts. Gold leaf, compass red, ocean blue, forest green, terracotta, and ink indigo category accents. Map panel cards with top-accent borders and cartographic marks. Search, filter, and copy instantly. 100% client-side, no signup.