[development team follows] API specification

1. URL Use horizontal bars to separate words

   /system-orders
   

2. The parameters are named after the small hump

   /system-orders/{orderId}
   

3. Get the plural words used in the collection

   GET /users
   

4. URL Don't use verbs in it

   PUT /user/{userId}
   

5. JSON The attribute is named after the small hump

   {
         
      userName: "Mohammad Faisal"
      userId: "1"
   }
   

6. The response body should contain the number of resources

   {
         
     users: [ 
        ...
     ],
     total: 34
   }
   

7. stay GET Always accept... In operation limit and offset Parameters

GET /shops?offset=5&limit=5

8. Add one fields Parameters , Public only API Required fields in

 Return only the name of the store , Address and contact information .
GET /shops?fields=id,name,address,contact

9. adopt HTTP Ask the head to carry Token

   Authorization: Bearer xxxxxx, Extra yyyyy
   

10. Always verify content type

```api
content-type: application/json
```

11. Yes CRUD Function USES HTTP Method

    GET： Retrieve the representation of the resource .
    POST： Create new resources and sub resources .
    PUT： Update existing resources .
    PATCH： Update existing resources , It only updates the fields provided , Without updating other fields .
    DELETE： Delete existing resources .
    

12. In nested data URL Use in HTTP Method

    GET /shops/2/products： from shop 2 Get a list of all products .
    GET /shops/2/products/31： Get product 31 Details of , product 31 Belong to shop 2.
    DELETE /shops/2/products/31： Products should be deleted 31, It belongs to the store 2.
    PUT /shops/2/products/31： Products should be updated 31 Information about , Only in resource-URL Upper use PUT, It's not a collection .
    POST /shops： A new store should be created , And return the details of the new store created . In collection url Upper use POST.
    

13. CORS Cross-domain resource sharing

     It must be for all public oriented API Support CORS（ Cross source resource sharing ） Head .
     Consider support CORS Allow the “*” source , And through effective OAuth Token forced authorization .
     Avoid combining user credentials with original authentication .
    

14. Security

     At all endpoints 、 Implement on resources and services HTTPS（tls encryption ）.
     Force and require all callbacks url、 Push notification endpoint and webhooks Use HTTPS.
    

15. General principles

     Flat is better than nested .
     Simplicity is better than complexity .
     Strings are better than numbers .
     Consistency is better than customization .