HTTP REST API
Developer EssentialsFoundationalFree

HTTP REST API

The course teaches HTTP protocol fundamentals and REST API conventions, covering HTTP methods, status codes, headers, authentication patterns, JSON request and response bodies, redirects, cookies, pagination, rate limiting, and file operations, with hands-on curl and jq exercises building toward a complete API client script.

Who Should Take This

Developers, DevOps engineers, and technical ops professionals who work with HTTP APIs and want to confidently interact with REST services using curl and jq, understand what status codes and headers mean, and build reliable API client scripts.

What's Covered

1HTTP Protocol Fundamentals
2Headers, Authentication, and Parameters
3Request and Response Bodies
4REST Conventions and Advanced curl
5Building API Client Scripts
6curl Advanced Features

What's Included in AccelaStudy® AI

Adaptive Knowledge Graph
Practice Questions
Lesson Modules
Console Simulator Labs
Exam Tips & Strategy
13 Activity Formats

Course Outline

1HTTP Protocol Fundamentals
3 topics

Request and Response Model

  • Describe the HTTP request structure: request line (method path HTTP/version), headers, blank line separator, and optional body, and explain how TCP connections underpin each request
  • Describe the HTTP response structure: status line (HTTP/version status-code reason-phrase), headers, blank line, and body, and explain Content-Length and Transfer-Encoding: chunked
  • Implement curl requests showing full request and response headers using curl -v and interpret the output including TLS handshake markers and header negotiation
  • Analyze HTTP keep-alive and connection reuse with curl --keepalive and describe how persistent connections improve performance for multiple sequential API requests

HTTP Methods

  • Identify the semantics of GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS and describe which are safe (no side effects) and which are idempotent
  • Implement curl commands for each HTTP method using -X flag and describe the difference between PUT (full replacement) and PATCH (partial update) for REST resource modification
  • Analyze why idempotency matters for retry logic and evaluate when to use POST versus PUT for resource creation in REST APIs that do or do not assign client-provided IDs
  • Implement HEAD requests using curl -I to retrieve response headers without a body and describe use cases for cache validation and content-type detection

HTTP Status Codes

  • Identify common status codes: 200 OK, 201 Created, 204 No Content, 301 Moved Permanently, 302 Found, 304 Not Modified, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 405 Method Not Allowed, 409 Conflict, 422 Unprocessable Entity, 429 Too Many Requests, 500 Internal Server Error, 502 Bad Gateway, 503.
  • Implement curl commands that inspect status codes using -o /dev/null -w '%{http_code}' and write retry logic distinguishing retryable (429, 503) from non-retryable (400, 401) errors
  • Analyze the distinction between 401 (authentication required) and 403 (authenticated but unauthorized) and evaluate when 422 versus 400 is more appropriate for validation errors
2Headers, Authentication, and Parameters
3 topics

HTTP Headers

  • Describe common request headers: Content-Type, Accept, Authorization, Cache-Control, User-Agent, Host, Cookie, and common response headers: ETag, Last-Modified, Location, Set-Cookie, WWW-Authenticate
  • Implement curl -H flags to set Content-Type: application/json, Accept: application/json, and custom API headers and explain how Content-Type drives request body parsing
  • Analyze ETag and Last-Modified conditional request patterns (If-None-Match, If-Modified-Since) and evaluate how they reduce bandwidth in polling scenarios

Authentication Patterns

  • Describe Basic authentication (Base64-encoded username:password in Authorization header) and Bearer token authentication and explain when each is appropriate
  • Implement Basic authentication in curl using -u username:password and Bearer token authentication using -H 'Authorization: Bearer TOKEN' for protected API endpoints
  • Implement API key authentication patterns using query parameters (?api_key=) and custom headers (X-API-Key:) and evaluate the security trade-offs of each approach
  • Analyze security risks of storing credentials in curl command history and evaluate strategies including environment variables, .netrc files, and curl config files
  • Analyze JWT Bearer token structure (header.payload.signature) and implement curl commands to decode the base64url payload section to inspect claims without a library

Query Parameters and URL Encoding

  • Describe URL structure (scheme, host, path, query string, fragment) and explain percent-encoding rules for spaces, special characters, and reserved characters in query parameters
  • Implement curl requests with multiple query parameters using URL encoding and use --data-urlencode for automatic encoding of special characters in form fields
  • Implement filtering, sorting, and field selection conventions using query parameters (filter[status]=active, sort=-created_at, fields=id,name) common in JSON:API compliant endpoints
3Request and Response Bodies
2 topics

JSON Request Bodies

  • Implement POST requests with JSON bodies using curl -d '{...}' -H 'Content-Type: application/json' and explain why Content-Type is required for server parsing
  • Implement curl requests reading JSON body from a file using -d @payload.json and from stdin using --data-raw and describe when each approach is preferable
  • Implement multipart form data file upload using curl -F 'file=@path' and describe the multipart/form-data content type and boundary separator format
  • Implement url-encoded form data submission using curl -d 'key=value&key2=value2' with Content-Type: application/x-www-form-urlencoded and compare it to JSON body POSTs

Processing Responses with jq

  • Implement curl and jq pipelines to pretty-print JSON responses, extract specific fields, and filter arrays based on property values from API responses
  • Implement shell scripts that combine curl API calls and jq to extract values for subsequent requests such as fetching an auth token and reusing it in API calls
  • Implement file download using curl -o filename and curl -O to save with server-provided filename and describe resumable downloads using -C -
  • Implement curl with --retry and --retry-delay flags for automatic retries on transient errors (6=connection failed, 28=timeout) and analyze which exit codes are retry-eligible
4REST Conventions and Advanced curl
3 topics

REST Architectural Principles

  • Describe REST constraints: stateless client-server communication, uniform resource interface with nouns (not verbs) in URLs, resource representation in JSON, and HATEOAS links
  • Implement a resource URL hierarchy following REST conventions: /users, /users/{id}, /users/{id}/posts, /users/{id}/posts/{pid} with appropriate HTTP methods for CRUD
  • Analyze REST API design trade-offs including nested versus flat resource URLs, versioning strategies (/v1/ prefix, Accept header, subdomain), and pagination cursor versus offset approaches
  • Describe HATEOAS (Hypermedia As The Engine Of Application State) and evaluate its practical implementation using _links, href, rel attributes in JSON REST API responses

Redirects, Cookies, and Pagination

  • Implement curl -L to follow 301/302 redirects automatically and explain the difference between 301 Permanent, 302 Temporary, 303 See Other, and 307 Temporary Redirect semantics
  • Implement cookie-based session management using curl -c cookie-jar.txt (save) and -b cookie-jar.txt (send) for APIs that use session cookies instead of Bearer tokens
  • Implement pagination handling in shell scripts by parsing Link headers or next_page tokens from JSON responses and looping curl requests until all pages are fetched
  • Evaluate Link header RFC 8288 format for web linking and implement parsing of next, prev, first, and last rel values for navigating paginated API collections

Rate Limits and Retry Logic

  • Describe rate limit response patterns including 429 Too Many Requests, Retry-After header, X-RateLimit-Remaining, and X-RateLimit-Reset headers
  • Implement exponential backoff retry logic in shell scripts that checks the HTTP status code and sleeps for Retry-After seconds before retrying 429 and 503 responses
  • Analyze the difference between jitter-based and fixed exponential backoff strategies and evaluate when circuit breaker patterns are needed for high-volume API clients
5Building API Client Scripts
2 topics

Composing curl API Workflows

  • Describe best practices for organizing reusable curl-based API scripts including base URL variables, auth token management, error checking with $?, and output formatting
  • Implement a complete API client shell script that authenticates, fetches paginated results, filters with jq, and writes output to a CSV file with proper error handling
  • Evaluate when a shell/curl script is the right tool versus using a purpose-built HTTP client library (Python requests, httpx) based on complexity, error handling, and team maintainability

Testing APIs and Debugging

  • Implement curl commands to test API endpoints including checking correct status codes, validating response schema with jq, and timing request latency using -w '%{time_total}'
  • Implement curl debugging techniques including --trace-ascii for full protocol inspection, --resolve for DNS override, and --proxy for routing through an HTTP proxy for analysis
  • Analyze common API error patterns: connection refused, SSL handshake failure, timeout, malformed JSON body, and 4xx authentication errors and implement curl-based diagnostic steps for each
  • Implement a curl-based smoke test script that validates API health endpoints return 200, authentication works, and a CRUD roundtrip succeeds before deploying a new service version
6curl Advanced Features
4 topics

curl Config and Scripting

  • Describe curl configuration file (~/.curlrc) for storing default flags like User-Agent, max-time, retry, and proxy settings to avoid repeating flags on every call
  • Implement curl --config flag to load options from a named config file for different API environments and credential sets without exposing secrets in shell history
  • Implement curl --parallel (-Z) for concurrent requests to multiple endpoints and analyze throughput improvements and connection limit trade-offs

Response Inspection and Timing

  • Implement curl -w format strings to capture response timing metrics: time_namelookup, time_connect, time_starttransfer, time_total, and speed_download for API performance analysis
  • Implement curl --dump-header to save response headers to a file and reuse Set-Cookie values in subsequent requests for stateful session workflows
  • Evaluate curl --connect-timeout versus --max-time and determine appropriate timeout values for different API types including fast REST vs slow async operations

HTTPS and Certificate Handling

  • Describe curl SSL/TLS options: --cacert for custom CA bundles, --cert and --key for mTLS client certificates, and --insecure (-k) for disabling certificate verification
  • Implement mTLS authentication using curl --cert client.crt --key client.key for APIs requiring mutual TLS and explain the difference from Bearer token authentication
  • Analyze the security implications of using --insecure in production scripts and evaluate safe alternatives like adding custom CA certs or updating the system trust store

Content Negotiation and Encoding

  • Describe content negotiation using Accept and Content-Type headers and explain how q-values (Accept: application/json;q=0.9, */*;q=0.8) indicate preference weights
  • Implement curl requests with Accept-Encoding: gzip, deflate and --compressed flag to receive and automatically decompress gzip-encoded responses from APIs
  • Analyze how Accept-Language and Content-Language headers affect internationalized API responses and evaluate localization conventions in REST API design

Scope

Included Topics

  • HTTP/1.1 request/response model, HTTP methods (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), HTTP status codes by category (1xx, 2xx, 3xx, 4xx, 5xx), HTTP headers (Content-Type, Accept, Authorization, Cache-Control, Location, ETag, Cookie, Set-Cookie), query parameters and URL encoding, JSON request and response bodies, REST architectural constraints (stateless, uniform interface, resource-based URLs), authentication patterns (Basic auth, Bearer tokens, API keys), pagination conventions, making HTTP requests with curl including flags (-X -H -d -u -o -L --data-raw), jq pipelines for processing responses, following redirects, handling cookies, file upload with multipart form data

Not Covered

  • GraphQL and gRPC protocols
  • WebSockets and Server-Sent Events
  • OAuth 2.0 authorization code flow and PKCE (Bearer token usage is included)
  • HTTP/2 and HTTP/3 protocol internals
  • TLS/SSL certificate management
  • API gateway configuration (Kong, AWS API Gateway internals)
  • OpenAPI specification authoring beyond basic endpoint documentation

Start HTTP REST API — free

Adaptive learning that maps what you already know and closes the gaps. No credit card, no trial clock, no paywall.

Enroll Free

More free Developer Essentials courses