DLDevLadder📒 My Notebook
Roadmap › 1. .NET › Step 21
API

ASP.NET Core Web API & REST

REST principles, controllers vs Minimal APIs, middleware, status codes, validation and ProblemDetails, JWT authentication, versioning, OpenAPI, caching, rate limiting, CORS, gRPC/SignalR and microservices basics.
Quick revision for interview day. Print it or save it as a PDF.

HTTP methods

MethodSafeIdempotentTypical response
GET✓✓200
POST✗✗201 + Location
PUT✗✓200/204
PATCH✗✗200/204
DELETE✗✓204

Status codes to remember

200 · 201 · 202 · 204 · 304 · 400 · 401 (who are you?) · 403 (not allowed) · 404 · 409 · 412 · 415 · 422 · 429 · 500 · 502 · 503 · 504.

Pipeline order

csharp
app.UseExceptionHandler();
app.UseHttpsRedirection();
app.UseCors("spa");
app.UseAuthentication();
app.UseAuthorization();
app.UseRateLimiter();
app.UseOutputCache();
app.MapControllers();

Minimal API essentials

MapGet/MapPost/MapPut/MapPatch/MapDelete · MapGroup · TypedResults · Results<Ok<T>, NotFound> · [AsParameters] · AddEndpointFilter · RequireAuthorization · RequireRateLimiting · WithTags/WithName.

Security

JWT = header.payload.signature (signed, not encrypted) · validate iss/aud/exp/signature · Auth Code + PKCE / Client Credentials · CORS ≠ auth · rate limit · HTTPS/HSTS · Key Vault.

Caching options

HTTP headers/ETag · Output cache · IMemoryCache · IDistributedCache (Redis) · HybridCache (.NET 9).

Remember

DTOs not entities · ProblemDetails for errors · CancellationToken everywhere · IHttpClientFactory · pagination with max size · version before breaking · idempotency keys for payments.