REST REST

REST is a style for building an API, and an API is simply how one program asks another program for information. The rule behind REST is short enough to say in one line. Every item the system holds gets its own web address, and you act on that address with the same small set of standard actions the web already uses.

Picture a clinic's patient list, where one address means all the patients. The same address with a number on the end means one particular patient, and that is the whole idea. To read that patient the program sends a get request, and to add a new one it sends a post. To replace the record it sends a put, and to remove it a delete. Those four words were not invented by the clinic system, because they are the ordinary instructions every web browser already sends.

The payoff is that everything becomes guessable. A developer who has used one REST API can usually work out the next one without reading a manual, and that is worth real money to you. Connecting a new supplier takes less time, and the person who takes over your system in three years does not have to learn a private language somebody made up. Most of the web applications Linkysoft builds speak REST for that reason alone.

REST has a weak spot that people usually find late, because each address returns only one kind of thing. A screen showing a patient, their last ten visits and their unpaid invoices may therefore need three or four separate requests. On an office connection nobody notices, but on a phone with one bar of signal it is the difference between a screen that opens and one that gives up. That is why, when we build a mobile app, we usually add one extra address that returns a whole screen in a single answer. The plain addresses stay where they are for everything else.

One more thing before you commission anything, because REST says nothing at all about who is allowed to ask. Every address is a door, so each door has to check the caller's identity and rights on its own. Missing that check on a single address is one of the most common ways a system leaks data. That is why a Linkysoft security review reads the address list line by line. So if you are paying for an API, ask to see that list, and ask who tested it.