API styles

It requires every response to say, implicitly or explicitly, whether it may be reused and for how long. In practice GET and HEAD responses are the cacheable ones; POST responses only with explicit freshness; PUT, PATCH and DELETE responses are never cached.

The client generates a unique key (usually a UUID) per logical operation and sends it as the Idempotency-Key request header. The server records the key with the result; if the same key arrives again it returns the stored response instead of re-executing. It makes retrying a POST safe.

Those details leak your internals to attackers — stack, framework versions, table names, ID ranges — and are useless to callers. Return a stable code, a safe message and a request id; keep the trace server-side in logs, keyed by that id.

It is a standard JSON format for HTTP error bodies, media type application/problem+json. Its members are type (a URI identifying the problem kind), title, status, detail and instance — all optional, plus your own extension members.

Retry-After tells the client how long to wait before trying again. It takes either delay seconds (Retry-After: 120) or an HTTP-date. Send it on 429 and 503, and on 3xx redirects that ask the client to wait.

A normalized store keys objects by type and id, not by the operation that fetched them. When a mutation's response carries the same id with new field values, the store overwrites that entity, and every view reading it updates.

A cached field is stored under a key made of the field name plus the arguments it was fetched with, because different arguments mean a different answer. Each page, fetched with a different cursor argument, therefore lands in its own entry.

A normalized client cache shreds each response into individual objects stored under an identity key, usually the object's __typename plus its id, with nested objects replaced by references. A document cache instead stores a whole response under the operation plus its variables.

An identifier for a document the server already holds, plus the variables. A build step extracts every operation from the client source into a manifest and publishes it ahead of the release; the shipped client carries identifiers, never query text.

HTTP caches key stored responses on the request method and target URL. Every GraphQL operation is POSTed to the same path, so the discriminator — the document and its variables — sits in a body no cache reads.

gRPC methods come in four kinds: unary (one request, one response), server-streaming (one request, many responses), client-streaming (many requests, one response) and bidirectional streaming. A device uploading samples for hours fits client-streaming.

With no deadline the call carries no grpc-timeout request field, and the gRPC specification tells the server to assume an infinite timeout. One stalled dependency then holds caller threads and memory until something else breaks.

Every gRPC call is an HTTP/2 POST whose :path is /{package}.{Service}/{Method}, with content-type application/grpc and te: trailers. The request body carries length-prefixed messages; nothing about the call lives in a query string.

An interceptor is a wrapper around a gRPC call that runs before and after the service method, on the client side or the server side, so cross-cutting work like authentication, audit logging, timing and tracing lives in one place.

Accepting a connection only proves a process bound its port. The grpc.health.v1 Health service's Check call returns a ServingStatus for a named service, so a caller learns whether the server can actually answer work rather than merely that it is listening.

A SOAP envelope is the root element: an optional Header of namespace-qualified header blocks, then a mandatory Body. The Envelope's namespace URI, not a version number, says SOAP 1.1 or 1.2; an unsupported one draws a VersionMismatch fault.

SOAP is a messaging protocol: an XML envelope carrying operations, usually described by a WSDL contract, over HTTP or other transports. REST is an architectural style: resources at URIs, acted on through HTTP's uniform methods and status codes.

A WSDL 1.1 document is an XML contract for a web service: types and message define the data, portType lists the abstract operations, binding fixes protocol and format, and service groups ports, each a binding at one address.

wsse:Security is the SOAP header block WS-Security defines for security data aimed at one recipient: tokens such as a UsernameToken, an X.509 certificate or a SAML assertion, a wsu:Timestamp, and the signatures and encryption keys protecting chosen parts.

SOAP 1.1 sends text/xml with a mandatory SOAPAction header and returns faults with HTTP 500. SOAP 1.2 sends application/soap+xml with an optional action parameter, returns Sender faults with 400 and other faults with 500, and also permits GET.

Nothing certain: a timeout only says no reply arrived in time. The request may have been lost before running, the transfer may have run and its reply been lost, or it may still be running, so the outcome is unknown.

A JSON-RPC 2.0 request carries jsonrpc "2.0", a method, optional params (an Array or an Object) and an id. The response echoes that id and carries exactly one of result or error, so the client correlates by id.

The client stub poses as the local procedure: it marshals the arguments into a request and hands it to the transport. The server skeleton unmarshals them, dispatches to the real procedure and marshals the result back.

RPC exposes named procedures the client calls with arguments; REST exposes addressable resources handled through HTTP's fixed methods; GraphQL exposes one typed graph the client queries for exactly the fields it wants. That organising choice drives caching, coupling and tooling.

Maybe sends once and never resends, so the call ran zero or one times. At-least-once resends until a reply arrives, so it may run repeatedly. At-most-once also resends, but the server spots duplicates by request identifier and replays its saved reply.

Append a key predicate to the entity set: Products(1), Employees('A1245'), OrderItems(OrderID=1,ItemNo=2). Inside a quoted string a single quote is doubled and a slash percent-encoded; OData 4.01 services may also accept Employees/A1245.

The OData service document at the service root lists entry points: entity sets, singletons and opted-in function imports, each with a name and URL. The $metadata document describes the whole model in CSDL: types, keys, relationships, operations and annotations.

Customers 21 to 30 of those in Lyon, sorted by Name, plus the total number of Lyon customers. The service evaluates $filter, then $count, then $orderby, $skip and $top, whatever their order in the URL.

Put both inserts in one change set, a nested multipart/mixed part whose operations each carry a Content-ID. POST the order as Content-ID 1, then POST the lines to $1/Items; the service applies all of them or none.

An entity's ETag comes from the ETag header of a single-entity response or, per entity, the @etag control information (@odata.etag in 4.0). It goes back unchanged in If-Match on PATCH, PUT, DELETE or a bound action; stale gets 412, missing-but-required 428.

The upgrade is an ordinary HTTP GET issued by the browser itself, and the page's socket API accepts only a URL and a list of subprotocol names. There is no place to add a request field, so no Authorization.

FIN says whether this frame is the last of its message; the 4-bit opcode says what the frame is: %x0 continuation, %x1 text, %x2 binary, %x8 close, %x9 ping, %xA pong. Three RSV bits sit between them.

A WebSocket client opens with an ordinary HTTP/1.1 GET carrying Host, Upgrade: websocket, Connection: Upgrade, a random Sec-WebSocket-Key and Sec-WebSocket-Version: 13. A 101 Switching Protocols response with a matching Sec-WebSocket-Accept means the socket is open.

A WebSocket endpoint that receives a Ping frame (opcode %x9) must answer with a Pong frame (opcode %xA) carrying identical application data. A completed round trip proves the peer's process read a frame and wrote one back.

A WebSocket text message must carry valid UTF-8, and an endpoint receiving invalid UTF-8 in one fails the connection with close status 1007. A binary message is an opaque sequence of octets the protocol never inspects.

A retry field sets, in milliseconds, how long a client waits before re-opening a dropped Server-Sent Events stream. Until the server sends one, the client uses an implementation-defined default of a few seconds.

An event-stream handler never finishes its response. It answers with 200 OK and Content-Type: text/event-stream, declares no body length, writes each event as that event happens, flushes, and holds the response open instead of returning a document.

Server-Sent Events defines automatic reconnection and a text event grammar over one ordinary HTTP response; a WebSocket connection defines neither, so you build them. The stream is server-to-client only, so anything the client sends needs a separate request.

The response is served as text/event-stream. Its body is a stream of field lines - data, event, id and retry - and a single blank line ends the current block and dispatches it as one event.

Authorization happens once, when the server answers the opening GET with 200 OK and a text/event-stream body. Nothing in the protocol re-checks it afterwards; the body is only data lines, so a fresh decision needs a fresh request.

Elicitation is MCP's way for a server to ask the human user for structured input while it is handling a request — a missing parameter, a confirmation, a choice between accounts. The client shows the ask and returns the user's answer.

The host is the AI application the user runs. Inside it, one client per server speaks the protocol. Each server exposes one integration's tools, resources and prompts. Clients never talk to each other.

Every MCP request must put io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities inside params._meta. An empty capabilities object is legal, but the key itself is not optional. clientInfo is optional and SHOULD be sent.

server/discover returns a DiscoverResult holding supportedVersions, the server's capabilities, optional instructions, and the required cache hints ttlMs and cacheScope, with serverInfo in _meta. Servers MUST implement it; clients MAY call it.

MCP protocol versions are dates in YYYY-MM-DD form naming the day of the last backwards-incompatible change to the specification. The current revision is 2026-07-28. Backwards-compatible additions do not bump the version.

OpenAPI parameter objects declare inputs outside the body using in: path, query, header, or cookie. A parameter is identified by name plus in. Path parameters must set required: true and must match a template variable in the path string.

It is a JSON Pointer into the same document: it resolves to the Pet entry under components.schemas, and tooling substitutes that definition wherever the reference appears, so one definition can serve many operations.

In an OpenAPI schema, required is an array of property names declared on the object schema itself, not a boolean on each property. It only guarantees the key is present — a required property can still hold null if the schema allows null.

In an OpenAPI schema, type is the JSON data type — string, number, integer, boolean, array, object — and is enforced by validators. format is an open-ended hint refining that type, such as int64 or date-time; validators may ignore unknown formats, but code generators use them for type mapping.

Security schemes live under components.securitySchemes as named entries. OpenAPI 3.0 defines four types — apiKey, http, oauth2 and openIdConnect — and 3.1 adds mutualTLS. Operations then reference a scheme by its name in a security requirement.

WebRTC still needs a signalling service to carry offers, answers and candidates, which the standards leave to the application; STUN to learn public addresses; TURN to relay when no direct path works; and media servers only for groups, recording or gateways.

Pick an RTCDataChannel when late inputs are worth dropping: it sends SCTP messages over DTLS and UDP, optionally unordered and partially reliable, often peer to peer. A WebSocket is one ordered, fully reliable TCP stream to a server, simpler to set up.

Each RTCIceServer entry in RTCConfiguration.iceServers names a server by a stun:, turn: or turns: URI. A STUN entry needs nothing more; a TURN entry must also carry username and credential, because the TURN server authenticates every Allocate before it spends relay capacity.

An SDP offer lists the media and data sections a peer proposes, with codecs, directions, ICE credentials and a DTLS fingerprint; the answer accepts or rejects each one. WebRTC never transports them: the application's own signalling channel carries offer, answer and candidates.

The ordered option chooses send-order or arrival-order delivery; maxRetransmits caps how often a lost message is resent, and maxPacketLifeTime caps how many milliseconds it may be sent or resent. Neither gives a reliable channel; both throws a TypeError.