API Versioning as a Translation Layer
API versioning as an architecture: requests enter through a version header, pass through a chain of reversible version changes, and reach controllers that only ever see the latest model.
Loading…
Topic
REST APIs
80 posts about REST APIs. Every summary links to the original.
- 80 posts
- 18 companies
- 1 explainer
See the idea
REST APIs explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Graph service platform
Grab's GrabDefence team required a dedicated graph infrastructure to proactively identify mobile fraud patterns, such as multiple accounts operating on shared physical devices and suspicious financial loops. To address this, the team built a four-layer Platform as a Service that encapsulates graph database operations behind uniform RESTful APIs for OLTP search and OLAP analysis. The architecture utilizes Amazon S3 for raw data files, Amazon Neptune for graph storage, DynamoDB for schema and metadata configurations, and Kafka for streaming ingestion. When users trigger data loading tasks, the service validates entity attributes against schemas stored in DynamoDB before importing records into Neptune. This infrastructure allows investigators to traverse adjacent account IDs and visualize complex entity relationships without managing underlying database runtimes.
Reliving Your Happiest HTTP Interactions with Ruby’s VCR Gem
Ruby’s VCR library records HTTP interactions and replays them in test suites, verifying requests and returning predictable responses; the post presents it as a way to manage complex WebMock stubs and multi-step or unreliable API behavior. It contrasts recordings from a live API with manually authored stubs: cassettes preserve observed behavior at recording time but are harder to change and do not update when the API changes. The guidance covers VCR.use_cassette, configurable request matching, YAML cassettes, before_filter logging, filter_sensitive_data, and safer recording modes such as :once and :none instead of :new_episodes. It recommends VCR for integration-focused tests involving unpredictable sequences, multiple calls, or troublesome APIs, while favoring WebMock or decomposition for simple calls and specific states; cassette isolation and inspection add debugging value but can hide interactions.
PostgREST 11 pre-release
PostgREST 11 is still in pre-release, with the latest features and fixes available through the Supabase CLI rather than Supabase Cloud. The update improves querying related data with spread operators that flatten one-to-one and many-to-one relationships into the response, avoiding an extra view or function for that shape. Related-table ordering is also supported, such as ordering films by technical_specs.duration, with the same relationship limitation. Anti-joins and inner-join behavior can be expressed by filtering related resources with is.null or not.is.null; the latter can also be combined with an or filter and is more flexible than the existing !inner modifier. The release can be tried locally with supabase start, and the post asks users to report bugs, suggestions, and ideas.
How to Export Datadog Metrics for Exploration in Jupyter Notebooks
Datadog dashboards can constrain metric analysis because they offer a limited set of visualizations and lack tooling for complex work such as statistical modeling. They also aggregate data over wider time ranges: the examples contrast one-second metrics across 15 minutes with two-hour intervals across 30 days, potentially hiding interesting events. The guide uses Datadog’s REST API and Python in Jupyter notebooks, requiring an API key, an APP key, and a metric query such as CPU utilization over time. It defines a time range, splits it into buckets whose width is controlled by time_delta, requests each window in a loop, appends the results, and converts them into a dataframe. The resulting data can be examined with tools such as seaborn; a KDE plot is used to inspect the distribution of system CPU utilization, with the exported data offering greater granularity than the dashboard example.
Supabase Beta August 2022
Supabase’s August 2022 Beta Update recaps Launch Week 5 releases, the Supa Hackathon, platform changes, migration resources, and community contributions. The release set includes Supabase CLI v1 with TypeScript type generation, the Management API Beta for programmatic project and organization control, and the supabase-js v2 release candidate with type support, new authentication methods, an async Auth overhaul, and Edge Functions improvements. Supabase also announced SOC2 compliance and made Realtime Presence and Broadcast available to all projects, alongside Vault, Auth UI, dashboard permissions, JSON schema validation, pg_graphql v0.4.0, and MFA early access. From September 11, HTTP API requests will redirect to HTTPS, and clients no longer need to send anon or service keys in the apiKey header; client-library users require no change.
PostgREST v10: EXPLAIN and Improved Relationship Detection
PostgREST v10 adds HTTP and supabase-js access to PostgreSQL execution plans for reads, writes, and RPC requests, with the feature restricted to development-oriented use through db-plan-enabled. Plans can be returned as text or JSON, analyzed to show execution time and RLS filtering, and queried in verbose form for the pg_stat_statements query identifier and related settings. The release also improves relationship detection: unique or foreign-key primary keys produce one-to-one JSON objects, while computed relationships let SQL functions define efficient links for views and materialized views. Many-to-many detection now requires a join table’s primary key to include both foreign-key columns, a breaking change; the post says PostgREST 10 was not yet on the Supabase Platform and was planned for release there over the following month.
Supabase CLI v1 and Management API Beta
Supabase CLI v1 is moving out of beta with capabilities for managing database migrations and generating TypeScript types, alongside a beta Management API. The CLI can manage organizations and projects, link projects locally, run schema and manual migration workflows, support CI/CD through local and GitHub Actions workflows, and generate types from local or remote databases. Migration changes include improved manually written migrations, an experimental migra-backed db diff that is faster and produces more concise DDL, and local branching for testing DDL without data loss; the source notes that generated scripts are not perfect. The REST-based Management API, previously called the Admin API, is consumed by the CLI and exposes programmatic management of organizations, projects, Edge Functions, and more, with endpoints intended for CI/CD and test-environment creation.
Fly Machines: an API for fast-booting VMs
Fly Machines are virtual machines exposed through a fast REST API, with boot times of about 300ms, intended to support cost-effective standby capacity and scale-to-zero applications. Creation is deliberately separated from starting: it performs a centralized database preflight, reserves host capacity through NATS, records the machine, and prepares the OCI image locally. A later start request goes to the nearest regional API, which sends a direct message to the known host, avoiding database coordination and image pulls; examples cite roughly 10ms locally and 150ms across regions. Processes can exit when idle to leave machines intact for clean restarts, while fly-proxy can start them for incoming HTTP requests. The design trades simplicity for hardware pinning, so capacity or host failures may require fallback machines and redundancy; stopped machines currently incur image-storage charges, such as about $0.15 per month for a 1GB Docker image.
Leveraging Shopify’s API to Build the Latest Marketplace Kit
Marketplace Kit version 2 provides boilerplate app code and documentation for third-party developers integrating with Shopify, implementing selected commerce features, and launching marketplaces across channels. The team moved away from using the Shopify CLI-generated Node app because CLI changes could affect their code and documentation, while its dependencies limited control over development practices. The new kit separates a full-stack merchant-facing admin app from a buyer-facing client app, using Express, React, NextJS, GraphQL, Apollo Client, and Apollo Server; open-source versions are publicly available. Its examples demonstrate JWT authentication through App Bridge and Shopify’s Node API, serving REST and GraphQL together with Express, and choosing REST for a product-listing count where a query offered no advantage.
Community Day
Supabase initiated its Launch Week with Community Day, announcing a series of ecosystem updates, security integrations, and open-source contributions. Through a partnership with GitHub, secret scanning now detects exposed Supabase service role API keys and automatically revokes them to prevent unauthorized database access. The pre-release of PostgREST version 10 introduces arrow operator queries for composite types and array elements, structured PostgreSQL-compliant error messages, and automated recovery from Linux EMFILE conditions. Authentication features expanded with four community-contributed OAuth providers, two phone providers, email one-time passwords via verifyOTP, and framework-specific supabase-auth-helpers starting with Next.js and Nuxt. Finally, Supabase launched a partner gallery powered by Postgres Full Text Search alongside educational courses and an upcoming ten-day virtual hackathon.
Supabase Beta November 2021: Launch Week Recap
Supabase celebrated its third Launch Week and one year in beta by rolling out several major infrastructure and tooling updates. The company open-sourced its Dashboard for self-hosting and integrated Logflare to provide searchable database and API logs directly in the interface. For database querying and APIs, Supabase introduced a Postgres extension that resolves each GraphQL request with a single SQL statement to minimize network IO overhead, while upgrading its default hosted database to PostgreSQL 14 and deploying PostgREST 9.0. Security capabilities were expanded by enabling Row Level Security policies across the Realtime API to restrict streams and subscriptions on a per-user basis. Additional releases during the week included faster media file delivery, an open-sourced launch methodology, and a free course combining Next.js, Stripe, and Supabase.
Community Day
Supabase kicked off its Launch Week by showcasing integrations, ecosystem updates, and community contributions across its open-source stack. The platform announced that all hosted projects are upgrading to PostgREST 9, introducing inner joins, functions with unnamed parameters, and PostgreSQL 14 compatibility. Through community contributions, Supabase expanded authentication options to include Slack, Spotify, and MessageBird alongside existing providers. Updates to the Python ecosystem include package renaming to supabase, synchronous operation support in postgrest-py, and a rewritten gotrue-py matching JavaScript feature parity. Additionally, Supabase partnered with GitGuardian to automate secret detection and remediation across development lifecycles, protecting sensitive database service role keys.
PostgREST 9
PostgREST 9 introduces several core updates to the tool that turns PostgreSQL databases into RESTful APIs. Developers can now perform inner joins when embedding tables using the !inner keyword, allowing top-level table rows to be filtered directly by embedded table attributes across multiple operators. The release also adds support for POST requests to functions containing a single unnamed parameter, which simplifies handling raw JSON payloads sent by external webhooks. To ensure compatibility with PostgreSQL 14, custom authentication functions accessing HTTP context headers and JWT claims must be updated to parse JSON properties from consolidated settings. Additional enhancements included in this version provide support for partitioned tables alongside documentation improvements and bug fixes.
Supabase Beta October 2021
Supabase announced its October 2021 beta release, introducing three new authentication providers for Slack, Spotify, and MessageBird phone logins. The platform rolled out database multi-schema support, enabling users to browse different database schemas directly within the Dashboard interface and query them through the PostgREST API after enabling schema access. Documentation and instructional resources were expanded to cover PostgreSQL functions, authentication server-side functions, RedwoodJS quickstarts, self-hosting architectures, and production readiness checklists. In addition to ecosystem releases such as supabase-py v0.0.3, nuxt-supabase v2.2.1, and vue-supabase v2.2.3, the project reached over 21,268 GitHub stars. The team also announced Launch Week III: The Trilogy, set to begin on November 29th on Discord.
Supabase $30m Series A
Supabase announced a $30 million Series A funding round led by Coatue, bringing its total funding to $36 million. The company aims to provide an open source alternative to Firebase while addressing the scalability limitations typical of abstracted database platforms. Rather than building a compatibility layer, Supabase provisions a full PostgreSQL database for every project alongside integrated authentication, storage, RESTful APIs, and realtime data streaming. Platform features rely directly on core PostgreSQL primitives, including Row Level Security policies, database triggers, and logical replication streams. Funding will support long-term development of a cloud-native PostgreSQL platform offering database branching, distributed read-write nodes, scalable storage, and ephemeral compute that scales down to zero.
API Tokens: A Tedious Survey
The post surveys API token schemes in the context of designing fine-grained permissions for Fly.io’s control-plane API, which currently provides all-or-nothing root credentials. It compares simple random tokens, platform tokens, OAuth 2.0, and other formats and protocols against revocation, database access, and vulnerability concerns, while distinguishing end-user API security from inter-service authentication and federated identity. The discussion explains how stateless signed tokens trade database lookups for cache-consistency and revocation problems, then presents Macaroons as a scheme the team plans to adopt, while noting that their expressiveness may be excessive for typical CRUD applications. Biscuits extend that model with public-key signatures and Protocol Buffers-encoded Datalog programs, offering unusually explicit authorization rules but demanding a potentially wholesale commitment to token-based policy. The conclusion favors simple random tokens for many CRUD applications, chooses Macaroons for the planned system, and advises against JWT.
Supabase Beta July 2021
Supabase concluded July 2021 with its second Launch Week event, delivering daily product updates and infrastructure upgrades across its platform. Authentication features expanded to support SMS logins through Twilio, Twitch authentication, and API endpoints for generating custom email authentication links. Storage capabilities were upgraded to include media streaming, public buckets, directory uploads, and speed improvements, alongside dashboard enhancements for usage statistics and database insights. Furthermore, all newly created Supabase projects now run PostgreSQL 13.3 by default, and instances incorporate the updated PostgREST version 8.0 server to generate CRUD APIs. The release also introduced preliminary components for Supabase functions as development continues toward general availability.
Updates for Supabase Functions
Supabase has announced an Alpha release of Database Webhooks alongside dashboard management tools for native PostgreSQL Functions and Triggers. Database Webhooks act as a wrapper around PostgreSQL triggers, asynchronously emitting HTTP GET and POST requests whenever table data is inserted, updated, or deleted. The networking layer relies on a new PostgreSQL extension called pg_net, which pairs a PostgreSQL background worker queue with libcurl to handle multiple concurrent outbound requests without blocking SQL queries. Although pg_net currently processes over 300 requests per second, Supabase plans to expand capabilities to include direct triggers for AWS Lambda and Google Cloud Run before launching dedicated Supabase Functions.
Supabase Storage now in Beta
Supabase released Storage Beta with several functional and architectural improvements three months after its alpha launch. The storage service now supports the Content-Range HTTP header for streaming audio and video, alongside entirely public buckets configured with dashboard safeguards and standard authorization policies. Directory uploads are enabled via the File and Directory entries API, while self-hosted instances can use a new local filesystem backend rather than requiring AWS S3 configuration. To support Node.js without adding polyfills or bundling complexity, the storage server was updated to accept binary data and streams directly. Additionally, the dashboard storage explorer simulates filesystem directories using hidden placeholder files and implements list virtualization.
Supabase Community Day
Supabase announced a series of platform upgrades and open-source contributions centered around PostgreSQL and its broader tooling ecosystem. Every new project on the platform now deploys on PostgreSQL version 13.3, accompanied by marketplace images on Digital Ocean and AWS. PostgREST version 8.0 incorporates upstreamed performance enhancements, achieving up to 50% more throughput on GET requests by adopting prepared statements for SELECT queries and decreasing log verbosity. The release eliminates downtime during schema cache reloads and replaces the pg_listen requirement with standard NOTIFY commands for dynamic in-database configuration updates. Additionally, community-led efforts introduced beta releases of Flutter and Dart client libraries alongside a dedicated Discord server for developer discussions.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.