Protocols and wire formats
REST, gRPC, GraphQL, Protobuf, Thrift, JSON, WebSockets, webhooks. The formats and protocols that connect services to one another, plus the cross-cutting concerns — versioning, authentication, idempotency, error envelopes — that show up regardless of which one you pick. Each sub-page below is a self-contained walkthrough.
Eleven sub-pages. Each is a long-form walk-through with code examples, diagrams, and links into the canon — RFCs, papers, and engineering writing worth keeping handy.
The eleven deep dives
REST
Resources, verbs, status codes, idempotency, HATEOAS. What Roy Fielding actually defined, what we ship in production, and how the constraints earn their keep.
gRPC
HTTP/2 framing, Protobuf payloads, the four streaming modes, deadlines, interceptors. The fastest mainstream RPC stack and where it earns its keep.
GraphQL
Schema, resolvers, the N+1 problem, DataLoader, persisted queries, federation. A query language for APIs and how it survives in production.
Protocol Buffers
Wire format, varints, ZigZag, field tags, schema evolution. The rules that let you change a Protobuf schema without breaking deployed clients.
Apache Thrift
Facebook's IDL with pluggable transports and protocols. The Compact Protocol, fbthrift, Finagle Thrift, and how it compares to gRPC + Protobuf.
JSON & JSON-RPC
The lingua franca of web APIs. Why it won, where it bites, and how JSON Schema, JSON-RPC, and binary cousins (CBOR, MessagePack, BSON) fit in.
WebSockets & SSE
Push to the browser. SSE for one-way, WebSockets for bidirectional, long-polling as fallback, WebTransport for the future. Production gotchas around proxies, timeouts, reconnects.
Webhooks
Server-to-server callbacks. At-least-once delivery, exponential retries with jitter, HMAC signatures, replay defense, dead-letter queues. The Standard Webhooks spec.
Versioning
URI vs header vs date-based. The deprecation playbook (Sunset header, brownouts, dual-write). Stripe's date-pinned approach, GitHub's vendor media types, AWS's URI versions.
Authentication
Five mainstream API auth schemes — API keys, OAuth 2.0 + PKCE, JWT, mTLS, HMAC-signed (SigV4). When each makes sense and the foot-guns to avoid.
Pagination, errors, idempotency
The cross-cutting practices that age well. Cursor pagination, RFC 9457 error envelopes, rate-limit headers, idempotency keys, request-id propagation, observability hooks.