Posts

The Postman app is an excellent tool for building and testing Web APIs. It gets even better when you combine it with Newman, which allows you to execute your Postman scripts on a continuous integration system like Bitbucket Pipelines. While both Postman and Newman are awesome, you may encounter issues while working with both apps. 1 2 3 if(pm.request.body.isEmpty){ // Code Omitted For Brevity } One issue you may encounter is having a script that was written in Postman, successfully tested using Postman, fail when executed using Newman. For example, the script above, which was written in Postman, is part of a series of tests that inspects the HTTP request body. The script can fail when executed on Newman because the function isEmpty does not exist. ...

I was recently presented with a unique challenge at work. I needed to create a script that clones repositories from Bitbucket. The problem is that as of June 2022, Bitbucket only supports managing repositories using OAuth via two grant types, the authorization code grant & the implicit grant. I won’t get into the details here but the implicit grant is no longer recommended and is in fact discouraged from ever being used. Regardless of which flow I use I will end up facing the same problem, the browser. In both the implicit and authorization grant, user interaction (3-legged OAuth) is required, the end-user must provide their credentials in order to properly authenticate, in some cases this may even include multifactor authentication. ...

I was recently talking to another developer about the importance of never exposing internal identifiers to the outside world. A well-known example of this is using an auto-incrementing identity field in SQL and exposing that field through an API. A client can look at the highest number to tell how many records exist, in an ordering system this is far from ideal. Now everyone will know how many orders you have created. I recommend watching The Internet of Pwned Things by Troy Hunt for a real-world example. ...

Learned a cool little trick a while back from Khalid. As a developer, you will often run into scenarios that require you to get a subset of all fields from a model. There are many ways to achieve this task, returning the type and then grabbing each property, for example, take the following User type. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 public class User { public User(string name, DateTime dob) { var random = new Random(); Id = random.Next(); Name = name; DateOfBirth = dob; } public int Id { get; set; } public string Name {get; set; } public DateTime DateOfBirth { get; set; } } If you want to obtain the name and id property you can take the following approach. ...

I’ve been thinking about what it takes to build a good Web API, regardless of the technology (REST vs GraphQL) or philosophy used. One concept that has been stuck on my head is the idea of marking up API documents to provide more context around the data. A Web API document is the response returned by the API itself, you will often see this term used in API specifications like GraphQL, HAL, JSON-LD, and JSON:API. Web API documents can be very simple, for example, imagine working with a Web API that manages users. This API may choose to represent the user resource using the following JSON. ...