skip to content

HATEOAS

Hypermedia links that tell a client what it can do next, the Richardson Maturity Model, and formats like HAL and JSON:API. Interviewers ask partly to see whether you know what full REST means, and partly to hear an honest take on why most APIs stop short of it.

part ofAPI stylesoverview, primer and where to startread it →
on this pageshow

questions

10

An order resource returns a cancel link while the order is pending, and stops returning it once the order has shipped. What is the client supposed to gain from that, and what does the client still have to know on its own?

level: middleimportance: should knowfreq 42%

basics

~20 s

The response advertises the transitions currently available, so the server owns the state machine and the client renders whatever affordances it is given instead of reimplementing the rules. The client still needs to understand each relation's meaning and what payload it takes, and the server still enforces every rule itself.

open as a page

Describe how a HAL document (media type application/hal+json) is laid out. What do the reserved _links and _embedded properties hold, and what problem does _embedded solve?

level: middleimportance: should knowfreq 38%

basics

~20 s

A HAL resource is ordinary JSON plus two reserved keys. _links maps relation names to link objects with an href (optionally templated, type, title). _embedded maps relation names to full nested resources, so a client gets related data in one response instead of following every link.

open as a page

How is a JSON:API document (media type application/vnd.api+json) laid out - what goes in data, relationships and included - and what does that structure buy you over ad-hoc JSON?

level: middleimportance: should knowfreq 34%

basics

~20 s

Top level holds data, errors or meta. data is a resource object with type, id, attributes and relationships; relationships hold identifier objects (type plus id) and links; included carries the full related resources, deduplicated. It gives you a normalised graph plus fixed conventions for includes, sparse fields and paging.

open as a page

Walk through the four levels of the Richardson Maturity Model for HTTP APIs, from level 0 to level 3, with an example of what an API looks like at each level.

level: middleimportance: should knowfreq 45%

basics

~20 s

Level 0: one URL, one verb, the operation named in the body. Level 1: many resource URLs. Level 2: proper HTTP verbs and status codes per resource. Level 3: responses carry hypermedia links telling the client what it can do next.

open as a page

Most APIs described as RESTful stop at level 2 of the Richardson Maturity Model. What does level 3 add, and what does an API that stops at level 2 actually give up?

level: seniorimportance: should knowfreq 35%

basics

~20 s

Level 3 puts links in responses so clients discover what they can do next. Stopping at level 2 means clients hardcode URL templates and duplicate the server's state machine - so URL changes and workflow rule changes become breaking changes.

open as a page

When would an API return a parameterised link such as /orders{?status,page} marked templated instead of a fully resolved URL, and what does RFC 6570 expansion require the client to do with it?

level: seniorimportance: nice to knowfreq 26%

basics

~20 s

Use a template when the target is a family of URLs the server cannot enumerate - search, filter, lookup by an id the client holds. The client must expand it with an RFC 6570 implementation, supplying named variables; expansion handles encoding and drops undefined variables, and only then is the result a usable URL.

open as a page

A HAL document can tell a client where to go but not how to submit a change. What does the Siren media type add with its actions array, and what does the HAL-FORMS extension do about the same gap?

level: seniorimportance: nice to knowfreq 18%

basics

~20 s

Siren entities carry an actions array where each action names itself and declares method, href, request content type, and a list of fields with names and types - enough for a client to render and submit a form. HAL-FORMS adds an equivalent _templates member to HAL documents.

open as a page

You are setting the response format for a new family of internal and partner-facing REST services. How would you choose between plain JSON, HAL, JSON:API and Siren, and why do those formats register distinct media types such as application/hal+json instead of just using application/json?

level: principalimportance: nice to knowfreq 24%

basics

~20 s

Choose by client population: plain JSON for lockstep first-party clients, HAL for light linking, JSON:API for graph-shaped entity APIs needing shared conventions, Siren or HAL-FORMS for generic clients that must be told how to act. Distinct media types make the format negotiable, and the +json suffix marks it as JSON-parseable.

open as a page

Why do so few public HTTP APIs reach level 3 of the Richardson Maturity Model, and under what conditions would you argue it is worth the cost?

level: principalimportance: nice to knowfreq 25%

basics

~20 s

Because the cost is paid by the API team while the benefit only materialises if clients are written to follow links - and almost none are. It pays off with many long-lived, independently-deployed clients you cannot redeploy on demand.

open as a page