SlashAI
27 Sep 2026 · 8 min readCoding

REST APIs and How to Call One

REST is a set of conventions rather than a specification, which is why it feels vague until you know the handful of things that actually matter. This guide covers the methods, the status codes worth memorising, what the headers are for, how authentication really works, and the error handling that separates a working integration from a flaky one.

The methods, and what they mean

  • GET — read something. Must not change anything, and a correct server enforces that.
  • POST — create something, or do something that does not map to another method.
  • PUT — replace a resource wholesale. The same request twice should leave the same result.
  • PATCH — partially update a resource.
  • DELETE — remove a resource.
bash
curl -s https://api.example.com/v1/notes/42 \
  -H "Authorization: Bearer $API_KEY"

curl -s -X POST https://api.example.com/v1/notes \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Ship it","done":false}'

Status codes worth memorising

  • 200 OK, 201 Created, 204 No Content — it worked.
  • 400 Bad Request — your request is malformed. Fix your code, not the server.
  • 401 Unauthorized — you are not authenticated. Missing, malformed or expired credentials.
  • 403 Forbidden — authenticated, but not allowed. The API will not change its mind.
  • 404 Not Found — the resource does not exist, or you are not allowed to know that it does.
  • 409 Conflict — the state does not allow this. Usually a duplicate or a stale version.
  • 429 Too Many Requests — rate limited. Back off and retry; do not hammer it.
  • 500 Server Error — their fault. Retry with backoff, and log the request id if there is one.
💡 Pro Tip: 401 means 'who are you', 403 means 'I know who you are and the answer is no'. Confusing the two is a classic sign you are looking in the wrong place.

Authentication and headers

  • API keys — a long string the server checks. Usually sent as a Bearer token in the Authorization header.
  • OAuth — a token with a scope and an expiry. Store it, check the expiry, and refresh before it fails rather than after.
  • Headers carry metadata: Content-Type, Accept, Authorization, and request-id for support.
  • Never put a secret in a query string. Query strings end up in server logs, proxies and browser history.

What separates a working integration from a flaky one

  • Set a timeout on every request. A hanging request will eventually take your app down with it.
  • Retry only 429 and 5xx, with exponential backoff and jitter. Retrying a 400 never succeeds and wastes your quota.
  • Handle pagination properly. Assuming one page is the most common reason data mysteriously goes missing.
  • Validate and parse responses rather than assuming the shape.
  • Log the status and a request id, never the full body if it may contain personal data.

Debug the call in the browser before writing any framework code: build it, inspect the real response, then turn that JSON into a TypeScript type so the rest of the integration is typechecked from the start.

API Tester freeMini Postman - test REST APIs from browserJWT Decoder freeDecode JWT header & payload locally, safelyJSON to TypeScript freeConvert JSON to clean typed TypeScript interfacesURL Encoder/Decoder freeEncode and decode URLsJSON Formatter freePretty print, minify, validate JSONJSON-YAML Converter freeConvert between JSON and YAML formats

All of these run in your browser — no account, no upload, free forever.

Explore the Full SlashAI Library

Every prompt in our guides is part of our offline-ready vault of verified commands and instant browser tools. Free forever, no account required.

Browse All Commands