REST API best practices in HLD - System Design Exercise

Design: REST API Design System

Design focuses on REST API best practices including endpoint design, security, versioning, error handling, and performance. Implementation details of backend services and databases are out of scope.

Functional Requirements

FR1: Design APIs that are easy to use and understand by developers

FR2: Support CRUD operations for resources

FR3: Ensure APIs are secure and handle authentication and authorization

FR4: Provide consistent and meaningful error responses

FR5: Support versioning to allow backward compatibility

FR6: Enable pagination, filtering, and sorting for list endpoints

FR7: Ensure APIs are performant with low latency

FR8: Provide documentation for API usage

Non-Functional Requirements

NFR1: Handle up to 10,000 concurrent API requests

NFR2: API response time p99 under 300ms

NFR3: Availability target of 99.9% uptime

NFR4: Support JSON as the primary data format

NFR5: Use standard HTTP methods and status codes

Think Before You Design

Questions to Ask

❓ Question 1

❓ Question 2

❓ Question 3

❓ Question 4

❓ Question 5

❓ Question 6

❓ Question 7

Key Components

API Gateway or Reverse Proxy

Authentication and Authorization Service

Rate Limiter

Logging and Monitoring

API Documentation Tool (e.g., OpenAPI/Swagger)

Backend Services handling business logic

Design Patterns

Resource-based URL design

Use of HTTP methods (GET, POST, PUT, DELETE, PATCH)

Statelessness in API design

Error handling with standard HTTP status codes

Versioning via URL path or headers

Pagination with limit and offset or cursor

Caching strategies

Reference Architecture

Client
  |
  v
API Gateway / Reverse Proxy
  |
  v
Authentication & Authorization Service
  |
  v
Backend Services
  |
  v
Database

Additional components:
- Rate Limiter attached to API Gateway
- Logging and Monitoring system connected to Backend Services
- API Documentation served via API Gateway

Components

API Gateway / Reverse Proxy

Nginx, Kong, or AWS API Gateway

Route requests, enforce rate limiting, handle SSL termination, and serve API documentation

Authentication & Authorization Service

OAuth 2.0, JWT tokens

Verify user identity and permissions before allowing access to APIs

Backend Services

RESTful web services built with frameworks like Express.js, Spring Boot, or Flask

Implement business logic and handle CRUD operations on resources

Database

Relational (PostgreSQL) or NoSQL (MongoDB)

Store persistent data for resources

Logging and Monitoring

ELK Stack, Prometheus, Grafana

Track API usage, errors, and performance metrics

API Documentation

OpenAPI (Swagger)

Provide interactive and up-to-date API usage documentation

Request Flow

1. Client sends HTTP request to API Gateway with resource URL and method

2. API Gateway authenticates request via Authentication Service using tokens

3. If authorized, API Gateway forwards request to appropriate Backend Service

4. Backend Service processes request, interacts with Database as needed

5. Backend Service returns response with appropriate HTTP status code

6. API Gateway applies rate limiting and caching if configured

7. API Gateway sends response back to Client

8. Errors are returned with standard HTTP status codes and JSON error messages

9. API Documentation is accessible via API Gateway endpoint

Database Schema

Key entities depend on API resources; for example, a User entity with fields (id, name, email, password_hash), and other resource entities with unique IDs and attributes. Relationships are defined as needed (1:N, N:N). The schema supports CRUD operations and indexing for efficient querying.

Scaling Discussion

Bottlenecks

API Gateway becoming a single point of failure under high load

Authentication Service latency affecting overall API response time

Database read/write bottlenecks with increasing data volume

Rate limiting causing request throttling during traffic spikes

Logging and monitoring overhead impacting performance

Solutions

Deploy API Gateway in a clustered, load-balanced setup with health checks

Use stateless JWT tokens to reduce authentication service calls; cache token validation results

Implement database read replicas and sharding; use caching layers like Redis

Use distributed rate limiting with token buckets and backoff strategies

Asynchronously process logs and metrics; use sampling to reduce volume

Interview Tips

Time: Spend 10 minutes understanding requirements and clarifying scope, 20 minutes designing the API best practices and architecture, 10 minutes discussing scaling and trade-offs, and 5 minutes summarizing.

Explain REST principles and importance of resource-based URLs

Discuss HTTP methods and status codes usage

Highlight security with authentication and authorization

Describe error handling and consistent response formats

Explain versioning strategies and why they matter

Mention pagination, filtering, and sorting for scalability

Talk about documentation and developer experience

Address scaling challenges and solutions realistically