HTTP & REST Quest

Tracks

1. 01🧱Foundations — The Wire You Were Already Using

   0/7 lessons

   TCP, TLS, HTTP versions, methods, headers, status code families

   Before REST design, before auth, before caching — there's the wire. Seven lessons take you from 'HTTP is the postal service of the web' down to request anatomy, the TLS handshake, the HTTP/1.1 vs 2 vs 3 evolution, every method, every header category, and the polymorphic dispatch of 1xx-5xx status codes. By the end, opening a request in DevTools stops feeling like Greek.

   Lesson list (7)

   • 01
     HTTP — The Postal Service of the Web~10 min · foundations, intuition, postal-service, stateless
   • 02
     Request & Response Anatomy — The Four Parts That Never Change~11 min · foundations, anatomy, request, response
   • 03
     TCP & TLS Underneath — The Layer Cake You Pretend Not to See~11 min · foundations, tcp, tls, https, transport
   • 04
     HTTP Versions — Same Semantics, Different Wire~11 min · foundations, http1, http2, http3, quic, multiplexing
   • 05
     Methods Overview — Seven Verbs Your Server Understands~10 min · foundations, methods, verbs, overview
   • 06
     Headers by Category — A Taxonomy You Can Actually Hold~11 min · foundations, headers, metadata, taxonomy
   • 07
     Status Code Families — A Polymorphic Protocol, Not a Lookup Table~12 min · foundations, status-codes, polymorphic, dispatch

   ✓Quiz · 6 questions→

2. 02🎯Semantics — The Invariants Methods Actually Promise

   0/6 lessons

   Idempotency, safety, cacheability, content negotiation, conditional requests, versioning

   Foundations told you the method names. Semantics tells you what each one promises to clients, proxies, and CDNs. Idempotency is the actual invariant (verb mapping is the consequence). Status codes are a polymorphic protocol (not a lookup table). Content negotiation is how clients and servers agree on format without pre-arranging anything. Conditional requests are cache contracts. By the end, you can defend every PUT vs POST choice with the three-property invariant, not folklore.

   Lesson list (6)

   • 01
     Idempotency & Safety — The Actual Invariants (Folklore Loses Here)~12 min · semantics, idempotency, safety, cacheability
   • 02
     Status Code Dispatch — The Specific Codes That Earn Their Keep~11 min · semantics, status-codes, dispatch, refinement
   • 03
     Content Negotiation — Agreeing on Format Without Pre-arranging~11 min · semantics, content-negotiation, accept, vary
   • 04
     Conditional Requests — Cache Contracts and Optimistic Locking~12 min · semantics, conditional-requests, etag, if-match, 304
   • 05
     Versioning Strategies — How APIs Evolve Without Breaking Clients~11 min · semantics, versioning, evolution, deprecation
   • 06
     Method Decision Table — Pick the Verb That Matches the Contract~10 min · semantics, methods, decision, synthesis

   ✓Quiz · 6 questions→

3. 03🏛️REST Design — Resources, URIs, HATEOAS Honestly

   0/7 lessons

   Resources vs RPC, URI design, the HATEOAS paradox, pagination, error envelopes

   REST is the architectural style Fielding described in 2000. What ships in 2026 under the name 'REST API' is mostly RPC dressed in HTTP. Both work; this track teaches you to tell which is which, design either one well, and stop arguing about HATEOAS without having read the dissertation. Seven lessons: resources vs RPC mental model, URI design rules, two lessons on HATEOAS (pure and honest), pagination patterns, query shape, and error envelope design.

   Lesson list (7)

   • 01
     Resources vs RPC — Two Mental Models, Both Valid~11 min · rest-design, resources-vs-rpc, mental-model
   • 02
     URI Design — Nouns, Plurals, and the Rules That Save You~10 min · rest-design, uri-design, naming
   • 03
     HATEOAS — What Fielding Actually Wrote (the Pure Version)~12 min · rest-design, hateoas, fielding, pure
   • 04
     HATEOAS — The Honest Reckoning (What Ships in 2026)~11 min · rest-design, hateoas, honest, rpc-over-http
   • 05
     Pagination — Cursor Beats Offset for Reasons You'll Hit~11 min · rest-design, pagination, cursor, offset
   • 06
     Filtering, Sorting & Sparse Fieldsets — The Query Toolkit~10 min · rest-design, filtering, sorting, fieldsets
   • 07
     Error Envelope Design — Give the Client Something to Work With~10 min · rest-design, errors, error-envelope, rfc7807

   ✓Quiz · 6 questions→

4. 04🛡️Auth & Security — Wire-Level, Not Hand-Waved

   0/6 lessons

   Bearer, API keys, JWT, OAuth2 with PKCE, CORS, rate limiting

   Most API auth bugs come from copy-paste OAuth flows whose internals nobody understands. This track unpacks the wire-level story: HTTP Basic and Bearer (the originals), API keys vs short-lived tokens (and when each fits), JWT structure and refresh flows, OAuth2 with PKCE (the modern canonical pattern), CORS as enforced server-declared policy, and rate limiting via 429 + Retry-After. Six lessons; concepts before libraries.

   Lesson list (6)

   • 01
     HTTP Basic & Bearer — The Two Auth Schemes the Protocol Knows~10 min · auth-security, basic, bearer, authorization
   • 02
     API Keys vs Short-Lived Tokens — Pick by Leak Risk~10 min · auth-security, api-keys, tokens, rotation
   • 03
     JWT & Refresh — The Format, the Claims, and the Refresh Dance~12 min · auth-security, jwt, claims, refresh
   • 04
     OAuth2 with PKCE — The Modern Canonical Flow~12 min · auth-security, oauth2, pkce, authorization-code
   • 05
     CORS Deep Dive — Server-Declared Policy, Browser-Enforced~12 min · auth-security, cors, preflight, browser
   • 06
     Rate Limiting — 429, Retry-After, and the Algorithms Underneath~10 min · auth-security, rate-limiting, 429, retry-after

   ✓Quiz · 6 questions→

5. 05⚡Caching & Performance — The Contract You Already Have

   0/5 lessons

   Cache-Control, ETag, conditional GET, CDN layers, compression, HTTP/2 multiplexing

   HTTP has a sophisticated caching protocol most APIs ignore. This track teaches you to USE it — Cache-Control as a contract between server and intermediaries, conditional GET as the fast path that skips body transfer entirely, CDN layers (browser / edge / origin) and which one your headers target, compression negotiation (gzip / brotli / zstd), and the HTTP/2 multiplexing wins that change client design assumptions inherited from HTTP/1.1. Five lessons.

   Lesson list (5)

   • 01
     HTTP Cache Headers — The Contract Servers Speak to Intermediaries~11 min · caching-perf, cache-control, etag, last-modified
   • 02
     Conditional GET — The Fast Path That Skips Bytes~10 min · caching-perf, conditional-get, 304, etag-revisited
   • 03
     CDN Layers — Browser, Edge, Origin (and Where Your Headers Land)~10 min · caching-perf, cdn, edge, origin
   • 04
     Compression & Keep-Alive — Free Bytes and Free Round Trips~10 min · caching-perf, compression, gzip, brotli, keep-alive
   • 05
     HTTP/2 Multiplexing — What Changes for Client Design~10 min · caching-perf, http2, multiplexing, client-design

   ✓Quiz · 5 questions→

6. 06🌊Streaming & Async — Where REST Ends

   0/5 lessons

   Polling → long-polling → SSE → chunked transfer → WebSocket handoff → webhooks

   REST is request/response. Real-time, push, and long-running operations need different patterns. This track walks the spectrum: polling (cheap, wasteful), long-polling (server holds the connection), SSE (one-way server-to-client streaming over HTTP), chunked transfer (the substrate SSE rides on), the WebSocket handoff (when you need full duplex), webhooks (inverted REST), and the 202 + Location async pattern. Five lessons.

   Lesson list (5)

   • 01
     Polling → Long-Polling — Cheap Real-Time Before WebSockets~10 min · streaming-async, polling, long-polling
   • 02
     Server-Sent Events — One-Way Streaming, Already in Your Browser~11 min · streaming-async, sse, event-stream, ai-streaming
   • 03
     Chunked Transfer Encoding — How HTTP/1.1 Streams Without Knowing the Size~9 min · streaming-async, chunked-transfer, http1
   • 04
     Where REST Ends and WebSocket Begins — The Handoff Decision~10 min · streaming-async, websocket, rest-vs-ws
   • 05
     Webhooks & Async-202 — Inverted REST and the Polling Pattern~10 min · streaming-async, webhooks, 202, async

   ✓Quiz · 5 questions→

7. 07🚀Production — The Real Job

   0/6 lessons

   Observability, curl, httpie/Postman, OpenAPI, client retry, API gateways

   The protocol details are necessary; running an API in production is sufficient. This track teaches the operational layer: correlation IDs that thread through distributed traces, curl as the universal debug tool, the GUI clients you'll actually reach for, OpenAPI as the wire's documentation, client design that survives partial failures (retry + circuit breakers), and the long-term stewardship of an API (gateways + versioning lifecycles). Six lessons.

   Lesson list (6)

   • 01
     Observability & Correlation IDs — The Thread Through the Distributed Maze~10 min · production, observability, correlation-id, tracing
   • 02
     curl — The Real Tool That Doesn't Lie~10 min · production, curl, debugging
   • 03
     httpie / Postman / Insomnia — The Tools You'll Actually Reach For~9 min · production, httpie, postman, insomnia, gui-clients
   • 04
     OpenAPI & JSON Schema — Your API's Machine-Readable Contract~11 min · production, openapi, json-schema, spec
   • 05
     Client Design — Retry, Backoff, Circuit Breakers~11 min · production, retry, backoff, circuit-breaker
   • 06
     API Gateways & Versioning Lifecycles — The Long Game~10 min · production, api-gateway, versioning, deprecation

   ✓Quiz · 6 questions→

8. 08🎓Epilogue — cwkPippa as Reference + Where to Go Next

   0/4 lessons

   Walk a real REST codebase, see what's not REST, build your own, look outward

   Seven tracks of theory; four lessons of reflection. The first walks cwkPippa's backend routes/ as a working REST + SSE + WebSocket reference. The second is the honest 'when not to use REST' (gRPC, GraphQL, RPC) section. The third is a tiny CRUD end-to-end that applies what you've learned. The fourth is a roadmap of where to go from here — the deeper topics this quest deliberately deferred.

   Lesson list (4)

   • 01
     cwkPippa as REST Reference — Walking a Real Codebase~10 min · epilogue, cwkpippa, synthesis, self-reference
   • 02
     When Not to REST — gRPC, GraphQL, and the Right-Tool Question~10 min · epilogue, grpc, graphql, alternatives
   • 03
     Build Your Own CRUD — The End-to-End That Cements Everything~12 min · epilogue, crud, synthesis, capstone
   • 04
     Where to Go From Here — The Roadmap This Quest Deferred~8 min · epilogue, roadmap, next-steps

   ✓Quiz · 4 questions→