# REST API glossary

78 REST API terms, from Novice to Master. Start with the basics or jump to a level.

Updated: September 28, 2026

## Novice

- [API](https://www.ask-codey.com/glossary/api): A set of rules that lets one program ask another for data or actions.
- [Client and Server](https://www.ask-codey.com/glossary/client-and-server): The client asks; the server answers.
- [Endpoint](https://www.ask-codey.com/glossary/endpoint-rest-api): One address an API offers: a method plus a path.
- [HTTP](https://www.ask-codey.com/glossary/http): The request-and-response language of the web.
- [HTTPS](https://www.ask-codey.com/glossary/https): HTTP over an encrypted connection.
- [JSON](https://www.ask-codey.com/glossary/json): The text format most APIs use for data.
- [Request](https://www.ask-codey.com/glossary/request): What the client sends: method, URL, headers and an optional body.
- [Resource](https://www.ask-codey.com/glossary/resource-rest-api): A thing an API lets you work with, identified by a URL.
- [Response](https://www.ask-codey.com/glossary/response-web-development): What the server sends back: a status code, headers and usually a body.
- [REST](https://www.ask-codey.com/glossary/rest): An API style built around resources with URLs, used through standard HTTP methods.
- [URL](https://www.ask-codey.com/glossary/url): The full address of a resource on the web.
- [Web API](https://www.ask-codey.com/glossary/web-api): An API you call over HTTP, usually getting JSON back.

## Apprentice

- [200 OK](https://www.ask-codey.com/glossary/200-ok): The request worked and the body holds the result.
- [201 Created](https://www.ask-codey.com/glossary/201-created): A new resource was created.
- [204 No Content](https://www.ask-codey.com/glossary/204-no-content): It worked and there is no body to return.
- [400 Bad Request](https://www.ask-codey.com/glossary/400-bad-request): The request is invalid, such as a missing or wrong field.
- [401 Unauthorized](https://www.ask-codey.com/glossary/401-unauthorized): No valid credentials were sent: sign in first.
- [403 Forbidden](https://www.ask-codey.com/glossary/403-forbidden): Signed in, but not allowed to do this.
- [404 Not Found](https://www.ask-codey.com/glossary/404-not-found): Nothing exists at that URL.
- [500 Internal Server Error](https://www.ask-codey.com/glossary/500-internal-server-error): Something broke on the server.
- [Content-Type](https://www.ask-codey.com/glossary/content-type): The header that says what format a body is in.
- [curl for APIs](https://www.ask-codey.com/glossary/curl-for-apis): A command-line tool for sending HTTP requests.
- [DELETE (HTTP)](https://www.ask-codey.com/glossary/delete-http): The method that removes a resource.
- [GET](https://www.ask-codey.com/glossary/get): The method that reads data without changing anything.
- [Header](https://www.ask-codey.com/glossary/header-web-development): A name-value line of extra information on a request or response.
- [HTTP Method](https://www.ask-codey.com/glossary/http-method): The verb that says what a request wants to do.
- [PATCH](https://www.ask-codey.com/glossary/patch-web-development): The method that updates only some fields of a resource.
- [Path Parameter](https://www.ask-codey.com/glossary/path-parameter-rest-api): A variable part of the URL path, like an ID.
- [POST](https://www.ask-codey.com/glossary/post): The method that creates a new resource.
- [Postman and Insomnia](https://www.ask-codey.com/glossary/postman-and-insomnia): Desktop apps for building and sending API requests by hand.
- [PUT](https://www.ask-codey.com/glossary/put): The method that replaces a whole resource.
- [Query String](https://www.ask-codey.com/glossary/query-string): The ?key=value part of a URL, used for filters and paging.
- [Request Body](https://www.ask-codey.com/glossary/request-body-web-development): The data sent with a request, usually JSON.
- [Status Code](https://www.ask-codey.com/glossary/status-code): The three-digit result number: 2xx success, 4xx client error, 5xx server error.

## Journeyman

- [409 Conflict](https://www.ask-codey.com/glossary/409-conflict): The request clashes with the current state, like a duplicate.
- [422 Unprocessable Content](https://www.ask-codey.com/glossary/422-unprocessable-content): Well-formed data whose values break the rules.
- [429 Too Many Requests](https://www.ask-codey.com/glossary/429-too-many-requests): You sent too many requests; wait and try again.
- [API Key](https://www.ask-codey.com/glossary/api-key): A secret string that identifies the calling program.
- [API Versioning](https://www.ask-codey.com/glossary/api-versioning): Letting an API change without breaking existing clients.
- [Authentication](https://www.ask-codey.com/glossary/authentication): Proving who you are.
- [Authorization](https://www.ask-codey.com/glossary/authorization): Deciding what an identified user is allowed to do.
- [Bearer Token](https://www.ask-codey.com/glossary/bearer-token): A token sent as "Authorization: Bearer ..."; whoever has it is treated as the user.
- [Cookie](https://www.ask-codey.com/glossary/cookie): Small data the browser stores and sends back to the same site on every request.
- [CORS](https://www.ask-codey.com/glossary/cors): Server rules that tell browsers which other sites may call it.
- [CRUD](https://www.ask-codey.com/glossary/crud): Create, Read, Update, Delete: the four basic data actions.
- [Filtering and Sorting](https://www.ask-codey.com/glossary/filtering-and-sorting): Query-string parameters that narrow and order a list.
- [Idempotent Method](https://www.ask-codey.com/glossary/idempotent-method): A request with the same effect whether sent once or many times.
- [JWT](https://www.ask-codey.com/glossary/jwt): A signed token carrying who the user is and when it expires.
- [Location Header](https://www.ask-codey.com/glossary/location-header): A header pointing to a new resource or a redirect target.
- [OpenAPI](https://www.ask-codey.com/glossary/openapi-rest-api): A standard machine-readable description of an API.
- [Pagination](https://www.ask-codey.com/glossary/pagination): Returning a large list in pages with a total count.
- [Problem Details](https://www.ask-codey.com/glossary/problem-details): A standard JSON shape for API error responses.
- [Resource Naming](https://www.ask-codey.com/glossary/resource-naming): Name endpoints with plural nouns and IDs, letting the method be the verb.
- [Safe Method](https://www.ask-codey.com/glossary/safe-method): A method that only reads and never changes data, like GET.
- [Stateless](https://www.ask-codey.com/glossary/stateless): Each request carries all it needs; the server remembers nothing in between.
- [Swagger UI](https://www.ask-codey.com/glossary/swagger-ui): An interactive web page, built from OpenAPI, for trying an API.

## Freelancer

- [API Gateway](https://www.ask-codey.com/glossary/api-gateway): A single front door that routes requests to many backend services.
- [Backend for Frontend](https://www.ask-codey.com/glossary/backend-for-frontend): A small server built for one front end, shaping data and holding tokens.
- [Caching Headers](https://www.ask-codey.com/glossary/caching-headers): Headers that say how long a response may be reused.
- [Conditional Request](https://www.ask-codey.com/glossary/conditional-request): A request that only proceeds if the resource is still in the expected state.
- [Content Negotiation](https://www.ask-codey.com/glossary/content-negotiation): The client asks for a format with Accept; the server picks one it supports.
- [Contract Testing](https://www.ask-codey.com/glossary/contract-testing): Checking an API still matches its agreed description.
- [ETag](https://www.ask-codey.com/glossary/etag): A version fingerprint that lets clients skip downloading unchanged data.
- [Idempotency Key](https://www.ask-codey.com/glossary/idempotency-key): A unique value that stops a retried POST from happening twice.
- [Long-Running Operation](https://www.ask-codey.com/glossary/long-running-operation): Answering 202 at once and letting the client poll a status URL.
- [OAuth 2.0](https://www.ask-codey.com/glossary/oauth-2-0): A standard for granting apps limited access via tokens instead of passwords.
- [OpenID Connect](https://www.ask-codey.com/glossary/openid-connect): Sign-in built on OAuth 2.0; used by "Sign in with Google".
- [Preflight Request](https://www.ask-codey.com/glossary/preflight-request): The OPTIONS check a browser sends before some cross-origin requests.
- [Rate Limiting](https://www.ask-codey.com/glossary/rate-limiting): Capping how many requests a client can send in a period.
- [Refresh Token](https://www.ask-codey.com/glossary/refresh-token): A long-lived token used to get new short-lived access tokens.
- [Webhook](https://www.ask-codey.com/glossary/webhook): An HTTP call a service sends to your URL when something happens.

## Master

- [API-First Design](https://www.ask-codey.com/glossary/api-first-design): Agreeing on the API contract before writing the implementation.
- [gRPC](https://www.ask-codey.com/glossary/grpc): A fast, binary, contract-first API style often used between services.
- [HATEOAS](https://www.ask-codey.com/glossary/hateoas): Responses include links to the next possible actions.
- [HTTP/2 and HTTP/3](https://www.ask-codey.com/glossary/http-2-and-http-3): Newer HTTP versions that send many requests at once over one connection.
- [Mutual TLS](https://www.ask-codey.com/glossary/mutual-tls): Both client and server present certificates to prove who they are.
- [Richardson Maturity Model](https://www.ask-codey.com/glossary/richardson-maturity-model): A four-level scale of how fully an API uses REST ideas.
- [Server-Sent Events](https://www.ask-codey.com/glossary/server-sent-events): A response kept open so the server can push a stream of events.

[More subjects in Web Basics](https://www.ask-codey.com/glossary/groups/web-basics)

Source: https://www.ask-codey.com/glossary/subjects/rest-api