API performance problems fall into two categories: the ones that appear immediately during development and are fixed before they matter, and the ones that are invisible during development and catastrophic at production scale. The second category is where the interesting work is. Understanding where APIs slow down under load — and the specific techniques that address each cause — is the difference between an API that performs at scale and one that requires emergency remediation after launch.

API security failures are not exotic. They rarely involve sophisticated attacks on cryptographic primitives or novel zero-day exploits. The most consequential breaches — the ones that expose millions of records, compromise user accounts, or shut down services — happen because an API allowed something it should not have, at a scale its designers did not anticipate. Understanding the fundamental attack surface of an API and designing against it deliberately is the entire discipline. It is not advanced knowledge. It is the baseline.

Testing an API is not the same as testing a library or a UI. An API is a contract — a public interface that other systems depend on — and the testing strategy must reflect that. Unit tests tell you whether individual functions work. Integration tests tell you whether the system behaves correctly end to end. Contract tests tell you whether the API still honors its published interface. Load tests tell you when it breaks. All four serve distinct purposes and none is a substitute for the others.

APIs are contracts. When you publish an API and someone builds an integration against it, they are betting their system on your endpoint continuing to behave as documented. Versioning is how you preserve that contract while still being able to evolve the underlying system. Done well, it gives you forward momentum without leaving integrators behind. Done poorly, it creates a maintenance burden that accumulates until one side gives up.

What Counts as a Breaking Change

The most important skill in API versioning is recognizing what requires a version increment. A breaking change is anything that causes a previously valid, working integration to fail or behave differently without modification. This is a broader category than most developers initially assume.

HTTP is a synchronous protocol. A client sends a request and waits for a response. This works well for operations that complete in milliseconds — a database read, a record update, a validation check. It breaks down for operations that take seconds, minutes, or longer: video transcoding, report generation, bulk data exports, machine learning inference on large inputs, email campaigns to millions of recipients.

Holding an HTTP connection open for a minute or more is technically possible and practically wrong. Clients time out. Load balancers have maximum request durations. Users cannot tell the difference between a server still working and a server that silently failed. Long synchronous operations produce brittle integrations and poor user experiences.

The standard REST pattern is one resource per request. Create one user, update one order, fetch one product. This works until an integrator needs to create ten thousand users, update five hundred orders, or sync an entire product catalog. Making ten thousand individual API calls is slow, expensive in terms of rate limit quota, and brittle — a network failure on request 7,432 leaves the integrator with a partially completed operation and no clean recovery path.

HTTP was designed from the beginning to support multiple representations of the same resource. A user profile can be represented as JSON for a machine consumer or as HTML for a browser. A dataset can be returned as JSON or as CSV depending on what the client intends to do with it. An image can be served as JPEG or WebP based on what the browser supports. Content negotiation is the mechanism through which clients and servers agree on which representation to use — and understanding it is essential for building APIs that serve diverse consumers cleanly.

CORS is the source of more developer frustration than almost any other browser security mechanism — not because it is poorly designed, but because its error messages are opaque, its rules are non-obvious, and it only manifests in a specific context that server-side developers often do not encounter during development. Understanding what CORS actually is and why it exists transforms it from an arbitrary obstacle into a predictable system with clear rules.

Developer experience is not a soft concern. It determines how quickly developers integrate your API, how many support tickets they file, how many abandon the integration and use a competitor, and how they describe your product to other developers. An API with good developer experience turns integrators into advocates. An API with poor developer experience turns them into complaints.

Good DX is not a single feature or a checklist item added at the end of the design process. It emerges from a series of small decisions made throughout design and implementation. Every naming convention, every error message, every documentation page, and every SDK is a DX decision.

APIs designed for desktop web clients on reliable broadband do not perform well on mobile without deliberate adaptation. Mobile clients operate under constraints that server-side developers often underestimate: variable and often poor network conditions, limited battery budgets where every radio transmission costs energy, smaller screens that need different data shapes than desktop, and the expectation of usable offline states that desktop web apps rarely require. Building an API that serves mobile clients well requires understanding these constraints and making design decisions that account for them.