open atlas

apis

APIs

How programs talk to each other over the network — the main styles (REST, GraphQL, gRPC), and how to design one that stays usable as it changes.

9 units·46 lessons·~39 h

Start track →
00

Start from zero

Before the senior material: what an API even is, and the handful of words the rest of the track assumes you already know.
01 Start from zero: what an API actually is 10 min
01

Rest modeling

Coming soon — API contracts
01 Modeling REST resources: nouns the client needs, not your verbs or tables 16 min 02 REST modeling: multiple-choice review 13 min 03 REST modeling: free-recall review 14 min 04 REST modeling: request and design reading 14 min 05 REST modeling: design an order API that survives change 220 min
02

Status codes real

Coming soon — API contracts
01 Status codes that actually matter in production 16 min 02 Status codes: multiple-choice review 13 min 03 Status codes: free-recall review 14 min 04 Status codes: reading HTTP exchanges 14 min 05 Status codes: ship an honest API 210 min
03

Pagination

Coming soon — API contracts
01 Pagination at scale: why OFFSET dies and keyset cursors survive 16 min 02 Pagination: multiple-choice review 13 min 03 Pagination: free-recall review 14 min 04 Pagination: SQL and code reading 14 min 05 Pagination: migrate an offset feed to keyset 220 min
04

Openapi

Coming soon — API contracts
01 OpenAPI: making the contract the source of truth, not the docs 16 min 02 OpenAPI: multiple-choice review 13 min 03 OpenAPI: free-recall review 14 min 04 OpenAPI: spec and diff reading 14 min 05 OpenAPI: make the contract load-bearing 220 min
05

Grpc protobuf

Coming soon — API contracts
01 gRPC and Protobuf: the binary contract and what it costs you 17 min 02 gRPC and Protobuf: multiple-choice review 13 min 03 gRPC and Protobuf: free-recall review 13 min 04 gRPC and Protobuf: schema and proto reading 14 min 05 gRPC and Protobuf: build a contract that survives evolution 240 min
06

GraphQL N+1 and the cost of nested resolvers

Why GraphQL turns one HTTP request into 1000 database calls, how DataLoader fixes it with a single event-loop tick, and the complexity / depth / persisted-query controls that keep public APIs alive.
01 Why GraphQL gets N+1 10 min 02 DataLoader mechanics: tick-boundary batching 13 min 03 Batch function contracts: ordering, shapes, errors 12 min 04 Federation and lookahead: batching beyond DataLoader 11 min 05 Query complexity defences: depth, cost, persisted queries 14 min 06 Senior GraphQL API: scheduling contract, tenant isolation, observability 18 min 07 GraphQL N+1: multiple-choice review 13 min 08 GraphQL N+1: free-recall review 14 min 09 GraphQL N+1: code reading 14 min 10 GraphQL N+1: batch and harden an API 240 min
07

Rate limiting

Coming soon — API contracts
01 Rate limiting: algorithms, the boundary burst, and the Redis counter 17 min 02 Rate limiting: multiple-choice review 13 min 03 Rate limiting: free-recall review 14 min 04 Rate limiting: code and snippet reading 14 min 05 Rate limiting: build a distributed limiter that actually holds 240 min
08

Putting it together

Coming soon — API contracts
01 Designing and reviewing a public API end to end 17 min 02 APIs: multiple-choice review 13 min 03 APIs: free-recall review 14 min 04 APIs: contract and response reading 14 min 05 APIs: design and build a production API 240 min

Build with this track

Guided projects that exercise what you learn here.

◆ Projects

Feature-flag service

Build a small flag service with targeting rules, percentage rollouts, and a typed SDK that evaluates flags client-side from a cached ruleset.
◆ Projects

Mini CRUD API

Build your first real backend: a tiny HTTP API that creates, reads, updates, and deletes notes — backed by SQLite so the data survives a restart. You go from a one-line 'hello' server to a small service that validates input and stores rows, one honest step at a time.
◆ Projects

Mini OAuth 2.0 + PKCE login

Implement the authorization-code + PKCE flow end to end against a real provider, so you understand every redirect and token instead of trusting a library.
◆ Projects

Presigned upload flow

Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.
◆ Projects

Distributed rate limiter

Build a token-bucket limiter that holds across many app instances by keeping the counter in Redis, not in process memory.
◆ Projects

Type-Safe API SDK

Build the client other engineers will actually trust: a typed SDK over a real HTTP API where the compiler — not a runtime crash in production — catches the wrong field, the missing variant, the response that lied about its shape. You model the domain with discriminated unions and generics, validate every response at the boundary, and let inference carry exact types all the way to the call site, with zero `any` left to paper over the gaps.
◆ Projects

URL shortener at scale

Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.
Next track

Databases

How databases store and find your data fast, keep it correct when many users write at once, and grow as the data gets bigger.