API Glossary

By the Syncfusion DevTutorials team · Last updated October 19, 2026

Every term from the course, A to Z, each explained in one or two plain sentences.

The API glossary explains every term that is used in this course, from A to Z, in one or two plain sentences for each term. Each entry names the lesson where the term is taught, so you can go back for the full story.

A

Access token

A short-lived token that the client sends with each request to prove who it is. In this course, it is a JWT in the Authorization: Bearer header. See Authentication.

API

An Application Programming Interface: an agreed way for one program to ask another program for data or actions. The Brew & Bytes app talks to the Brew & Bytes API to read the menu and to place orders. See What Is an API.

API gateway

A single front door that sits in front of several services. It sends each request to the right service, and it does shared jobs such as auth checks, rate limits and logging. See API Gateway.

API key

A long secret string that identifies a calling app, usually a partner or another server. It is sent in a header such as X-Api-Key. See Authentication.

Audience (aud)

The JWT claim that says which API the token is for. Your API must reject tokens that were made for a different audience. See Authentication.

Authentication

Finding out who is calling. A missing or bad credential gets 401 Unauthorized. See Authentication.

Authorization

Deciding what the caller is allowed to do. A known caller who is not allowed gets 403 Forbidden (or 404 for someone else's record). See Authorization.

B

Backoff

Waiting longer between each retry, for example 1, 2, and then 4 seconds. Exponential backoff with jitter stops many clients from retrying at the same moment. See Rate Limits and Resilience.

Bearer token

A token that is sent as Authorization: Bearer <token>. Whoever holds ("bears") it can use it, so keep it secret. See Authentication.

BOLA

Broken Object Level Authorization: a user reads or changes another user's record just by changing an id in the URL. Fix it by checking that the owner of the record matches the caller from the token. See Authorization.

Body

The data part of a request or response, after the headers. In this course, it is usually JSON. See HTTP Basics.

Breaking change

A change that makes existing clients fail. Examples are renaming or removing a field, changing a type, or adding a required request field. It needs a new API version. See API Versioning.

C

Cache

A stored copy of a reply that can be used again, instead of asking the server again. The Cache-Control header says who may cache the reply and for how long. See Performance and Caching.

Circuit breaker

A guard that stops calling a failing service for a while, after too many errors. It fails fast, instead of piling more load on a sick service. See Rate Limits and Resilience.

Claim

One piece of information inside a JWT, such as sub (the user id), exp (the expiry time) or role. See Authentication.

Client

The program that sends requests: a mobile app, a website, a partner's server, or another service. See What Is an API.

Contract

The promise that an API makes about its URLs, fields, types and status codes. Clients depend on it, so changing it can break them. See What Is an API and OpenAPI.

Contract test

A test that checks that the real API still matches its OpenAPI document. See OpenAPI.

Correlation id

A unique id that is given to one request. It is sent back in X-Correlation-Id, and it is written on every log line for that request. It lets you find all the logs for one customer problem. See Monitoring and Observability.

CORS

Cross-Origin Resource Sharing: a browser rule that blocks a web page from reading replies from a different site, unless that API allows it with Access-Control-Allow-Origin. See API Authorization and Security.

CRUD

Create, Read, Update, Delete: the four basic actions on data. In REST, they match POST, GET, PUT or PATCH, and DELETE. See Building a CRUD API.

Cursor pagination

Paging through a list with a marker such as ?after=105, instead of a page number. It stays correct when new items arrive while you scroll. See REST API Design.

D

DataLoader

A helper that collects the ids that many GraphQL resolvers ask for, and loads them in one batch. It fixes the N+1 problem. See GraphQL.

Deadline

In gRPC, the latest time when a call may finish. After that time, the call fails with DEADLINE_EXCEEDED. See gRPC.

Deprecation

Telling clients that a version or a field will be removed. The Deprecation and Sunset headers carry this warning. See API Versioning.

DTO

Data Transfer Object: a small class or type that defines exactly what a request or a response contains. Separate request and response DTOs stop over-posting and hide internal fields. See Request Validation.

E

Endpoint

One method plus one path that your API answers, such as GET /orders/{id}. See REST API Design.

ETag

A version tag that the server sends with a reply, such as ETag: "menu-12". The client sends it back in If-None-Match, and it gets 304 Not Modified if nothing changed. See Performance and Caching.

Expiry (exp)

The JWT claim that says when the token stops being valid. Always check it. See Authentication.

G

gRPC

A style for fast calls between services. Messages are defined in a .proto file, and they are sent as small binary protobuf over HTTP/2. See gRPC.

GraphQL

A query language where the client asks for exactly the fields that it needs from one endpoint, usually POST /graphql. See GraphQL.

H

Header

A Name: value line in a request or response that carries extra information, such as Content-Type or Authorization. See HTTP Basics.

Health check

An endpoint such as /health/ready that says whether the service and its database are working. Load balancers use it to decide where to send traffic. See Monitoring and Observability.

HTTP

HyperText Transfer Protocol: the request and response format that REST APIs use. See HTTP Basics.

HTTP/2

A newer version of HTTP that sends many requests over one connection. gRPC is built on it. See gRPC.

I

Idempotency key

A unique value that is sent in the Idempotency-Key header with a POST. If the same key arrives again, the server returns the first result, instead of doing the work twice. See HTTP Methods.

Idempotent

A request that has the same effect whether you send it once or many times. GET, PUT and DELETE are idempotent. POST is not. See HTTP Methods.

Integration test

A test that sends real requests to your running API, in memory, and checks the status, the headers and the body. See API Testing.

Issuer (iss)

The JWT claim that names who made the token. Your API should accept only issuers that it trusts. See Authentication.

J

Jitter

A small random amount that is added to each backoff wait, so that clients do not all retry at the same moment. See Rate Limits and Resilience.

JSON

JavaScript Object Notation: the text format that most APIs use for bodies, such as { "item": "Latte", "quantity": 2 }. See HTTP Basics.

JWT

JSON Web Token: a signed token that is made of three parts (header, payload and signature) separated by dots. The server checks the signature and reads the claims. See Authentication.

L

Latency

How long a request takes from start to finish. Watch p95, not the average. See Monitoring and Observability.

Location header

The response header that gives the URL of a newly created resource. It is sent with 201 Created. See Status Codes.

Long-running job

Work that takes too long for one request. The API answers 202 Accepted with a Location for the job, and the client checks back later. See REST vs GraphQL vs gRPC.

M

Metrics

Numbers that are counted over time, such as requests per second, error rate and duration. See Monitoring and Observability.

Method

The first word of a request (GET, POST, PUT, PATCH, DELETE) that says what the client wants to do. See HTTP Methods.

Middleware

Code that runs for every request, before or after your endpoint. Examples are logging, auth, or adding a correlation id. See Monitoring and Observability.

N

N+1 problem

Running one query for a list, and then one more query for each item. The page gets slower as the list grows. Fix it with one batched query or a DataLoader. See Performance and Caching and GraphQL.

O

OAuth 2.0

The standard way for an app to get an access token from a sign-in server, without ever seeing the user's password. See API Authentication.

Observability

Being able to tell what your API is doing from the outside, by using logs, metrics and traces. See Monitoring and Observability.

OpenAPI

A standard document (JSON or YAML) that describes every endpoint, field and status code of a REST API. Tools use it for docs pages and generated clients. See OpenAPI.

Over-fetching

Getting more data than the screen needs. GraphQL lets the client ask for only some fields. See GraphQL.

Over-posting

A client sends extra fields, such as price, that the server should not accept, and the server saves them. Prevent it with a request DTO that has only the allowed fields. See Request Validation.

P

p95

The 95th percentile: 95 out of 100 requests were faster than this number. It shows what slow users feel, which an average hides. See Monitoring and Observability.

Pagination

Splitting a long list into pages with a limit, so that one request never returns everything. See REST API Design.

Path parameter

A value inside the URL path, such as 105 in /orders/105. See REST API Design.

Payload

The data that is carried in a request or response body. In a JWT, it is the middle part that holds the claims. See HTTP Basics.

PKCE

Proof Key for Code Exchange. The app sends a hash of a secret when sign-in starts, and it sends the secret itself when it collects the token. So a stolen sign-in code is useless. See API Authentication.

Polling

Asking the server again and again, "Is there anything new?". It wastes requests. Webhooks or SSE are often better. See REST vs GraphQL vs gRPC.

Preflight

An OPTIONS request that the browser sends before some cross-site calls, to ask if they are allowed. See API Error Reference.

Problem Details

The standard JSON shape for errors, with type, title, status, detail and instance. It is sent as application/problem+json. See Status Codes.

protobuf

Protocol Buffers: the format that gRPC uses. You define messages in a .proto file, and each field has a number that is used on the wire instead of its name. See gRPC.

Q

Query (GraphQL)

A GraphQL request that reads data. A mutation changes data. See GraphQL.

Query string

The part of a URL after ?. It is used for filters, sort and paging, such as ?status=open&limit=20. See REST API Design.

R

Rate limit

A cap on how many requests one caller can make in a time window. Going over it gets 429 Too Many Requests. See Rate Limits and Resilience.

Readiness check

A health check that says if the service can take traffic right now, including its database. See Monitoring and Observability.

Refresh token

A longer-lived token that is used only to get a new access token when the old one expires. See Authentication.

Request

The message that a client sends: a method, a URL, headers, and sometimes a body. See HTTP Basics.

Resolver

A function in a GraphQL server that fetches the value for one field. See GraphQL.

Resource

A thing that your API manages. It is named by a noun in the URL, such as an order at /orders/105. See REST API Design.

Response

The message that the server sends back: a status code, headers, and sometimes a body. See HTTP Basics.

REST

Representational State Transfer: a style where resources have URLs and HTTP methods act on them. It is the default choice for public APIs. See REST API Design.

Retry

Sending a failed request again. It is safe only for idempotent requests, or for a POST with an Idempotency-Key. See Rate Limits and Resilience.

Role

A named group of permissions, such as customer or staff. It is often carried as a JWT claim. See Authorization.

S

Safe method

A method that changes nothing on the server: GET, HEAD and OPTIONS. See HTTP Methods.

Schema

A description of the shape of data. In GraphQL, it lists every type and field. In validation, it lists the rules for a body. See GraphQL and Request Validation.

Scope

A named permission that is given to a token or a key, such as orders:read. Each endpoint checks for the scope that it needs. See Authorization.

Span

One timed step inside a trace, such as "query the database" or "call the payment service". See Monitoring and Observability.

SSE

Server-Sent Events: a long HTTP response where the server pushes updates to the browser as they happen, such as an order moving to "ready". See REST vs GraphQL vs gRPC.

Status code

The three-digit number in a response that says how the request went, such as 200, 404 or 500. See Status Codes.

Streaming

In gRPC, a call where the client, the server, or both send many messages over one call. See gRPC.

Structured logging

Writing log entries as fields (status, duration, correlation id) instead of plain sentences, so that you can search and count them. See Monitoring and Observability.

Subject (sub)

The JWT claim that holds the id of the user. Use it as the owner of new records. See Authentication.

Sunset

The date when an old version stops working. It is sent in the Sunset header. See API Versioning.

T

Test pyramid

Many fast unit tests, fewer integration tests, and a few end-to-end tests. See API Testing.

Timeout

The longest time that a client will wait for a reply before it gives up. See Rate Limits and Resilience.

Token

A string that proves who the caller is, or what it may do. See Authentication.

Trace

The full path of one request across all the services that it touched. It is made of spans that share one trace id. See Monitoring and Observability.

U

Under-fetching

Needing several requests to get all the data for one screen. GraphQL can fetch it in one query. See GraphQL.

Unit test

A test of one small piece of code, such as a service method, with no HTTP. See API Testing.

URL

The address of a resource, such as https://api.brewbytes.dev/v1/orders/105. See REST API Design.

V

Validation

Checking that the values of a request follow your rules before you use them, and answering 422 (or 400) with every problem listed. See Request Validation.

Varint

A way that protobuf stores whole numbers in as few bytes as needed. Small numbers such as 2 take one byte. See gRPC.

Versioning

Running more than one shape of an API at the same time, such as /v1 and /v2, so that old clients keep working after a breaking change. See API Versioning.

W

Webhook

An HTTP POST that your API sends to the URL of a partner when something happens, such as "order ready". Sign it, so that the partner can trust it. See REST vs GraphQL vs gRPC.

Wire format

The exact bytes that are sent over the network. JSON is text. Protobuf is binary and smaller. See gRPC.