Self-Paced REST API Course

Personal REST API Learning Portal

Master REST APIs step-by-step at your own pace. Track your completion, test endpoints live, and build confidence from scratch.

🎓 Your Personal Progress: 0% Completed
💡 30-Second Visual Summary

What is an API in simple terms?

Think of an API as a waiter in a restaurant connecting you (the customer) to the kitchen (the server):

🙋‍♂️

1. You (The Client)

You look at the menu (Documentation) and place your request (e.g. GET /campaigns/301).

2. Waiter (The API)

The API safely carries your order to the backend server and ensures authentication is valid.

🖥️

3. Kitchen (Server & DB)

The server fetches data from MySQL and sends back a response in JSON format + Status Code.

Problem-First Approach

Imagine opening Instagram or an Ad App on your phone...

When you open an app, your phone doesn't store millions of posts or ad campaigns locally. How does your phone know which ads or user posts to display? It asks the server!

That structured conversation between your app (Client) and the server happens through an API (Application Programming Interface).

📱 Client (App)
HTTP Request ➔
⚡ API Endpoint
SQL Query ➔
🗄️ Database
JSON Data ➔
📱 Render UI

HTTP & URL Anatomy

REST is Built On HTTP

Without HTTP, REST APIs do not exist! A browser sends an HTTP Request to a server, and the server returns an HTTP Response.

🔍 Anatomy of an API Endpoint URL

https://api.adtechsanto.fun/v1/campaigns/301?status=active&limit=10
Protocol (https://) Secure encrypted communication channel.
Domain (api.adtechsanto.fun) The server host address on the internet.
Version (/v1) Prevents breaking existing apps when API changes.
Resource (/campaigns) The target data entity collection in MySQL.
Path Parameter (/301) Identifies 1 specific record (Campaign ID #301).
Query Params (?status=active) Optional filters and pagination after the ? symbol.
💡 Pro Tip (Path Param vs Query Param): /campaigns/301 targets one exact entity ID, whereas /campaigns?status=active filters a list of entities.

Headers & Security

The 3 Big Header Questions & Token Auth Flow

📋 The 3 Big Header Questions

Authorization
"Who are you?"

Carries API keys or JWT tokens: Bearer eyJhbGci...

Content-Type
"What format are you sending?"

Tells the server how to parse the request body: application/json

Accept
"What response format do you want?"

Requests JSON back from the server: application/json

🔐 Complete Token Authentication Lifecycle

  1. 1
    User Log In: App sends POST /auth/login with email + password.
  2. 2
    Server Check: Backend verifies password hash in database.
  3. 3
    JWT Generation: Server creates an encrypted JWT Bearer Token.
  4. 4
    Token Storage: Client saves token in localStorage or secure cookie.
  5. 5
    Future Requests: Client attaches Authorization: Bearer <token> to every API call.

Data Format

JSON Deep-Dive (JavaScript Object Notation)

JSON is the universal language of REST APIs. Learn the data types used in request bodies and responses.

Objects {} Key-value pairs enclosed in curly braces.
{ "id": 301, "status": "active" }
Arrays [] Ordered lists enclosed in square brackets.
[ "banner", "video", "native" ]
Primitives Strings, Numbers, Booleans (true/false), and null.
{ "cpm": 2.50, "is_active": true }
Nested Payload Example Combining objects and arrays in real AdTech payloads.
{
  "campaign_id": 301,
  "line_items": [
    { "id": 501, "budget": 1200 }
  ]
}

First Learning Roadmap

Simple 4-Step Learning Path

01
Learn the words first Start with API, REST, endpoint, request, response, JSON, and status codes so the later sections feel easy instead of abstract.
02
Read real examples Compare a GET, POST, PUT, PATCH, and DELETE side by side so you can see what changes in the URL, headers, body, and response.
03
Practice safely Use the simulated API Lab to send your own requests without touching real production data or needing a complicated setup.
04
Explain it back clearly Use the challenge cards, quiz, and interview questions to turn memorized ideas into confident explanations.

Why REST API Matters

Why this skill matters in real work

APIs connect systems

Frontends, servers, databases, analytics tools, and ad platforms all rely on APIs to exchange data.

APIs power real products

Login flows, profile pages, order creation, reporting, campaign updates, and dashboards all run through API calls.

API fluency helps in many roles

Developers, TAMs, support teams, solution engineers, and AdTech teams all need to read requests and debug responses.

Debugging APIs is practical work

Understanding 401, 404, 409, CORS, bad JSON, and slow queries is part of real production support.

REST API In Baby Steps

Build the basics one concept at a time

01

What is an API?

A way for one system to ask another system for data or actions.
💡 A waiter between you and the kitchen.
GET /api/v1/lab-playground.php?resource=campaigns&id=301
02

What is REST?

A common way to design APIs around resources like campaigns, line items, or creatives.
💡 Labeled folders with clear actions.
GET /campaigns
PATCH /campaigns/301
03

What is an endpoint?

The exact URL route you call on a server.
💡 An apartment number, not just the building.
GET /api/v1/lab-playground.php?resource=campaigns&id=301
04

What is a request?

The method, URL, headers, query params, and body sent by the client.
💡 A full order slip.
{
  "method": "POST",
  "url": "/api/v1/lab-playground.php?resource=campaigns"
}
05

What is a response?

The status code, headers, and data returned by the server.
💡 The tray coming back from the kitchen.
{
  "status": 201,
  "data": {"id": 301, "name": "Q3 Video Campaign"}
}
06

What is JSON?

A simple text format for structured data.
💡 A labeled packing list.
{
  "id": 301,
  "name": "Q3 Video Campaign",
  "budget": 5000
}
07

What are methods?

GET reads, POST creates, PUT replaces, PATCH updates part, DELETE removes.
💡 Different buttons for different actions.
GET /campaigns
POST /campaigns
DELETE /creatives/901
08

What are headers?

Extra request instructions like auth, content type, and accepted format.
💡 Sticky notes on the package.
Content-Type: application/json
Authorization: Bearer token
09

What are query params?

Extra filters after the URL path.
💡 Customizations after choosing the base item.
GET /campaigns?status=active&limit=10
10

What are status codes?

Quick numeric summaries of what happened.
💡 Signal lights before the full explanation.
200 OK
404 Not Found
500 Internal Server Error

How API Works In Real Life

Client -> request -> endpoint -> server logic -> database -> response

Think about this flow whenever you debug login, fetch profile, create order, update campaign, or delete record issues.

Client / App

Browser, mobile app, Postman, or frontend code starts the call.

Request

Method, URL, headers, and body travel to the backend.

API Endpoint

The server routes the request to the right code.

Server Logic

Validation, auth, and business rules run here.

Database / Service

The backend reads or writes data in MySQL or another service.

Response

The backend sends JSON and a status code back to the client.

HTTP Methods Comparator

All 5 methods at a glance

Compare GET, POST, PUT, PATCH, and DELETE side-by-side to understand what each method does.

GET

Read data

Endpoint: /campaigns

GET /campaigns?status=active
{
  "items": [{"id":301,"name":"Q3 Video Campaign"}]
}

💡 Use: Fetch active campaigns or line items.

POST

Create data

Endpoint: /campaigns

{
  "name": "Q4 CTV Campaign",
  "budget": 10000
}
{
  "id": 302,
  "name": "Q4 CTV Campaign"
}

💡 Use: Create a campaign, creative asset, or user account.

PUT

Replace a full record

Endpoint: /campaigns/301

{
  "name": "Q3 Video Campaign (Updated)",
  "budget": 7500,
  "status": "active"
}
{
  "id": 301,
  "name": "Q3 Video Campaign (Updated)"
}

💡 Use: Overwrite an entire campaign configuration.

PATCH

Update part of a record

Endpoint: /campaigns/301

{
  "status": "paused"
}
{
  "id": 301,
  "status": "paused"
}

💡 Use: Change a single field like status or daily budget.

DELETE

Remove data

Endpoint: /creatives/901

DELETE /creatives/901
{
  "deleted": true,
  "id": 901
}

💡 Use: Archive or delete an unused creative asset.

Status Codes Matrix

Read the status code before reading the message

Status codes act as instant signal lights telling you if a request succeeded, failed due to bad client input, or crashed on the server.

🟢 2xx Success

Everything Worked!

  • 200 OK — Request worked
    Fetch campaigns returns data.
  • 201 Created — New record created
    Creating a line item returns new row.
🟡 4xx Client Error

Check Your Request!

  • 400 Bad Request — Input or body is wrong
    POST body missing campaign name.
  • 401 Unauthorized — Not authenticated
    Calling private reporting API without auth.
  • 403 Forbidden — Authenticated but not allowed
    Trafficker tries to delete advertiser account.
  • 404 Not Found — Route or record missing
    Requesting campaign id 9999.
  • 409 Conflict — Request conflicts with existing data
    Creating a line item with duplicate flight code.
🔴 5xx Server Error

Server Had a Problem!

  • 500 Internal Server Error — Backend failed
    Database connection or query failure.

Architecture & Design

REST Principles, REST vs GraphQL & Idempotency

🏛️ The 5 Core Principles of REST

1. Client-Server Frontend UI and Backend Database are completely decoupled.
2. Stateless Every request must contain all info needed (no session state stored on server).
3. Cacheable Responses explicitly declare if they can be cached to save bandwidth.
4. Uniform Interface Standardized HTTP methods (GET, POST, PUT, DELETE) and resource URIs.
5. Layered System Intermediaries (proxies, load balancers, gateways) can exist invisibly.

⚡ REST vs GraphQL Comparison

Feature REST API GraphQL
Endpoints Multiple (/campaigns, /creatives) Single Endpoint (/graphql)
Data Fetching Fixed payload per route Client asks for exact fields
Overfetching Possible (returns extra fields) Eliminated (exact query)
Caching Built-in HTTP caching Requires custom client caching

🔄 Idempotency Visually Explained

An operation is idempotent if executing it 1 time produces the exact same server result as executing it 100 times.

PUT /campaigns/301 ✅ Idempotent (Safe to Retry)

Run 1x: Overwrites Campaign #301 ➔ Budget = $5,000

Run 2x: Overwrites Campaign #301 ➔ Budget = $5,000 (No duplicate created!)

POST /campaigns ❌ Non-Idempotent (Creates Duplicates if Retried)

Run 1x: Creates Campaign #301

Run 2x: Creates Campaign #302 (Duplicate row created!)

Developer Debugging

Inspect APIs in Browser DevTools & Code Progression

How real engineers inspect API requests in production using F12 DevTools Network Tab.

🛠️ How to Debug Any API with Chrome DevTools (F12)

1 Press F12 Open Chrome DevTools and select the Network tab.
2 Filter 'Fetch/XHR' Filter out images & CSS to focus strictly on API calls.
3 Click Any Request Select a request row to inspect its exact request & response payloads.
4 Check Headers & Response Verify Status Code (200/401/404), Authorization headers, and returned JSON.
curl -X POST https://api.adtechsanto.fun/v1/campaigns \
  -H "Authorization: Bearer demo-token-xyz" \
  -H "Content-Type: application/json" \
  -d '{"name": "Q3 Video Campaign", "budget": 5000}'
const response = await fetch('https://api.adtechsanto.fun/v1/campaigns', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer demo-token-xyz',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ name: 'Q3 Video Campaign', budget: 5000 })
});
const data = await response.json();
console.log(data);
import requests

url = "https://api.adtechsanto.fun/v1/campaigns"
headers = {
    "Authorization": "Bearer demo-token-xyz",
    "Content-Type": "application/json"
}
payload = {"name": "Q3 Video Campaign", "budget": 5000}

response = requests.post(url, json=payload, headers=headers)
print(response.json())
<?php
$ch = curl_init('https://api.adtechsanto.fun/v1/campaigns');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer demo-token-xyz',
    'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'name' => 'Q3 Video Campaign',
    'budget' => 5000
]));
$response = curl_exec($ch);
curl_close($ch);
?>

AdTech Domain Focus

Real-World AdTech Industry APIs

See how REST & JSON APIs power ad servers, Demand-Side Platforms (DSPs), Mobile Attribution (MMP), and Supply-Side Platforms (SSPs).

Google Ad Manager API

Publisher Line Item Creation

Publishers use GAM REST/SOAP APIs to automate line item creation and targeting rules.

POST /v202402/LineItemService
{
  "name": "Q3 Video Pre-Roll 300x250",
  "lineItemType": "STANDARD",
  "costPerUnit": { "currencyCode": "USD", "microAmount": 2500000 },
  "targeting": { "inventoryTargeting": { "targetedAdUnits": ["1234567"] } }
}
OpenRTB 2.5 Protocol

Real-Time Auction Bid Request JSON

SSPs send OpenRTB JSON bid requests to DSPs within 100ms auctions.

POST /openrtb2/auction
{
  "id": "auction_987654321",
  "imp": [{ "id": "1", "banner": { "w": 300, "h": 250 }, "bidfloor": 1.50 }],
  "site": { "domain": "adtechsanto.fun", "page": "https://adtechsanto.fun" },
  "device": { "ua": "Mozilla/5.0", "ip": "172.56.21.9" }
}
MMP Attribution API

Mobile App Install Postback

Mobile Measurement Partners post install conversion data back to ad networks.

POST /v1/postback/install
{
  "app_id": "com.game.app",
  "advertising_id": "38400000-8cf0-11bd-b23e-10b96e40000d",
  "media_source": "AdTechSanto_DSP",
  "campaign": "Q3_AppInstall_US",
  "event_time": "2026-07-26T17:50:00Z"
}

Request And Response Examples

See the full shape of common calls

GET

GET All Campaigns

Base URL: /api/v1
Path: /campaigns
Query Params: ?resource=campaigns&status=active
Full Endpoint: /api/v1/lab-playground.php?resource=campaigns
💡 How to do it yourself: Set Method to GET ➔ Enter Full URL ➔ Add Accept header ➔ Click Send.
Headers
Accept: application/json
Request body
No body needed (GET requests do not send JSON bodies).
JSON response (200 OK)
{
  "status": 200,
  "items": [
    {"id": 301, "name": "Q3 Video Campaign", "budget": 5000}
  ]
}
GET

GET Single Campaign by ID

Base URL: /api/v1
Path: /campaigns/301
Query Params: ?resource=campaigns&id=301
Full Endpoint: /api/v1/lab-playground.php?resource=campaigns&id=301
💡 How to do it yourself: Set Method to GET ➔ Target campaign ID #301 in URL ➔ Click Send.
Headers
Accept: application/json
Request body
No body needed.
JSON response (200 OK)
{
  "status": 200,
  "data": {"id": 301, "name": "Q3 Video Campaign", "status": "active"}
}
POST

POST Create New Campaign

Base URL: /api/v1
Path: /campaigns
Query Params: ?resource=campaigns
Full Endpoint: /api/v1/lab-playground.php?resource=campaigns
💡 How to do it yourself: Set Method to POST ➔ Add Content-Type header ➔ Enter JSON Body ➔ Click Send.
Headers
Content-Type: application/json
Accept: application/json
Request body
{
  "name": "Q4 Mobile App Install",
  "budget": 7500,
  "status": "active"
}
JSON response (201 Created)
{
  "status": 201,
  "created": true,
  "data": {"id": 302, "name": "Q4 Mobile App Install"}
}
PATCH

PATCH Update Campaign Status

Base URL: /api/v1
Path: /campaigns/301
Query Params: ?resource=campaigns&id=301
Full Endpoint: /api/v1/lab-playground.php?resource=campaigns&id=301
💡 How to do it yourself: Set Method to PATCH ➔ Target ID #301 ➔ Send only changed status field ➔ Click Send.
Headers
Content-Type: application/json
Accept: application/json
Request body
{
  "status": "paused"
}
JSON response (200 OK)
{
  "status": 200,
  "updated": true,
  "data": {"id": 301, "status": "paused"}
}
DELETE

DELETE Archive Creative Asset

Base URL: /api/v1
Path: /creatives/901
Query Params: ?resource=creatives&id=901
Full Endpoint: /api/v1/lab-playground.php?resource=creatives&id=901
💡 How to do it yourself: Set Method to DELETE ➔ Target creative ID #901 ➔ Click Send.
Headers
Accept: application/json
Request body
No body needed.
JSON response (200 OK)
{
  "status": 200,
  "deleted": true,
  "id": 901
}

Real-World API Challenges

Practical debugging scenarios

Why am I getting 401 Unauthorized?

Symptom: API says you are not authenticated.

Likely cause: Missing or expired token, wrong header format.

How to debug: Check Authorization header and token expiry.

Possible fix: Send a valid token or key again.

Why is my POST request failing?

Symptom: Create request returns 400 or 409.

Likely cause: Bad JSON, missing fields, duplicate unique value.

How to debug: Check Content-Type and compare body fields to the contract.

Possible fix: Send valid JSON and unique data.

Why is the response empty?

Symptom: Success response but no data.

Likely cause: Filters exclude everything or no rows exist.

How to debug: Remove filters and check the table data.

Possible fix: Seed data or fix query filters.

Why am I getting 404 Not Found?

Symptom: Route or record cannot be found.

Likely cause: Wrong URL or missing ID.

How to debug: Compare path spelling and record id.

Possible fix: Use the right endpoint or create the record first.

Why is CORS blocking my request?

Symptom: Browser fails before the API completes.

Likely cause: Server did not allow the frontend origin or header.

How to debug: Inspect browser devtools network headers.

Possible fix: Configure safe CORS rules on the backend.

Why is JSON parsing failing?

Symptom: Backend says the body is invalid.

Likely cause: Bad commas, missing quotes, or wrong content type.

How to debug: Validate the JSON body separately.

Possible fix: Send proper JSON with application/json.

Why is API latency high?

Symptom: Response works but feels slow.

Likely cause: Slow queries, big payloads, or downstream calls.

How to debug: Measure DB time, payload size, and dependencies.

Possible fix: Index queries, paginate, or cache.

Why is authentication token expired?

Symptom: Earlier calls worked, now 401.

Likely cause: Token lifetime passed.

How to debug: Check token expiry and refresh flow.

Possible fix: Refresh or re-login for a new token.

Why am I getting 500 Internal Server Error?

Symptom: Backend crashes unexpectedly.

Likely cause: Unhandled exception or DB failure.

How to debug: Read server logs and stack traces.

Possible fix: Fix backend code and add safer error handling.

Interactive API Test Lab

Try a safe simulated API playground directly on this page

This playground uses internal mock responses so beginners can safely practice methods, URLs, headers, bodies, status codes, and debugging without touching production data.

Quick Examples

Load a ready-made request into the playground

Use one of these presets if you want to see a working request immediately before editing the method, headers, or body yourself.

Example 1

List Users

Safe GET example returning a mock user collection.

Example 2

Get User 101

Fetch one simulated user record.

Example 3

Create User

Simulate a POST create request with JSON.

Example 4

Update Campaign

Simulate patching a campaign status.

Example 5

Authenticated Profile

Try a request with a bearer token header.

Example 6

Trigger 404

Practice reading a not-found response.

Equivalent cURL
curl "/api/v1/lab-playground.php"

Practice Tasks

Mini tasks that help the flow click

Fetch all users

Goal: Read the full mock user list.

Endpoint: /api/v1/lab-playground.php?resource=users

Expected output: 200 OK with an items array.

Hint: Use GET and no body.

Fetch one user

Goal: Read one mock user.

Endpoint: /api/v1/lab-playground.php?resource=users&id=101

Expected output: 200 OK with one data object.

Hint: Use the id query param.

Create a new user

Goal: Simulate creating a user safely.

Endpoint: /api/v1/lab-playground.php?resource=users

Expected output: 201 Created with a generated mock row.

Hint: Send name, email, and role.

Update a campaign status

Goal: Simulate a partial update.

Endpoint: /api/v1/lab-playground.php?resource=campaigns&id=301

Expected output: 200 OK with updated campaign data.

Hint: Use PATCH and send only the changed fields.

Delete a record

Goal: Simulate deleting one mock row.

Endpoint: /api/v1/lab-playground.php?resource=users&id=102

Expected output: 200 OK with deleted_id.

Hint: Use DELETE.

Send auth-style header

Goal: Practice using headers cleanly.

Endpoint: /api/v1/lab-playground.php?resource=profile

Expected output: 200 OK with a mock authenticated profile.

Hint: Use Authorization: Bearer demo-token.

Debug a 404

Goal: Trigger a not-found case on purpose.

Endpoint: /api/v1/lab-playground.php?resource=users&id=9999

Expected output: 404 Not Found.

Hint: Use an id that does not exist.

Identify a wrong request body

Goal: See validation fail.

Endpoint: /api/v1/lab-playground.php?resource=users

Expected output: 400 Bad Request.

Hint: Try POST without email.

Quiz / Questions & Answers

Score yourself and reveal concept answers

Pick an option below, then click "Check answer" to see if you're right. Your score updates in real-time.

Score0 / 12
Answered0
StatusIn progress
Q1

What does an API do?

Q2

Which method is mainly used to read data?

Q3

True or False: JSON is common in API request and response bodies.

Q4

Which status code means a new record was created?

Q5

What is an endpoint?

Q6

True or False: Headers can carry authentication information.

Q7

What is a likely reason for 404?

Q8

Which method is best for creating a new user?

Q9

True or False: Query params are useful for filtering or pagination.

Q10

What does 401 usually mean?

Q11

Which method is often idempotent for full replacement?

Q12

True or False: A 500 response usually means a backend failure.

Authentication vs authorization?

Why do status codes matter?

Why debug with curl or an API lab?

What makes an API beginner-friendly?

REST API Interview Questions

Simple answers with real-world examples

What is a REST API?

Simple answer: A resource-oriented HTTP API style where methods like GET, POST, PUT, PATCH, and DELETE act on resources.

Real-world example: Example: `/users` for a list and `/users/101` for one user.

Difference between GET and POST?

Simple answer: GET reads data. POST usually creates data or triggers an action.

Real-world example: Example: GET `/reports`, POST `/reports/export`.

PUT vs PATCH?

Simple answer: PUT usually replaces a full record. PATCH updates only the fields you send.

Real-world example: PATCH may send only `{ "role": "manager" }`.

What is 404?

Simple answer: It means the route or resource was not found.

Real-world example: Example: requesting a user id that does not exist.

Authentication vs authorization?

Simple answer: Authentication proves identity. Authorization checks permission.

Real-world example: A logged-in user may still not be allowed to delete.

What is JSON?

Simple answer: A text format used to structure request and response data.

Real-world example: Example: `{ "id": 1, "name": "Riya" }`.

What is an endpoint?

Simple answer: The exact API URL a client calls.

Real-world example: Example: `GET /api/v1/lab-playground.php?resource=users&id=101`.

What are headers?

Simple answer: Extra metadata sent with the request or response.

Real-world example: Example: `Content-Type: application/json`.

What can cause 500?

Simple answer: Backend exceptions, bad SQL, missing env vars, or dependency failures.

Real-world example: Example: database connection failure.

What is idempotency?

Simple answer: Repeating the same request should leave the same final result.

Real-world example: PUT with the same full record twice should not create duplicates.

REST API Learning Path

A simple roadmap from zero to confidence

Stage 1

Basic API concepts

Learn API, REST, endpoint, request, response, and JSON.

Stage 2

Methods and status codes

Understand GET, POST, PUT, PATCH, DELETE and the common status families.

Stage 3

Request and response handling

Practice headers, bodies, path params, and query params.

Stage 4

Authentication basics

Learn API keys, bearer tokens, and permission checks.

Stage 5

Testing and debugging

Use the API Lab, curl, devtools, and Postman.

Stage 6

Real-world challenges

Work through 401, 404, CORS, latency, parsing, and 500 cases.

Stage 7

Interview preparation

Practice explaining concepts clearly with examples.

Go Deeper

Continue with the rest of the REST API track

AdTech glossary

Definitions and examples for programmatic, CTV, privacy, and protocols.

Open page

REST API Basics

Go deeper into first principles and curl examples.

Open page

Intermediate REST

Study pagination, auth, validation, and frontend usage.

Open page

Advanced REST

Move into idempotency, retries, tracing, and caching.

Open page

MySQL + JSON

See how PHP, MySQL, and JSON fit together in a real site.

Open page

Next Step

Keep practicing until request and response flow feels natural

Start with the API Lab, move through the challenge cards, then use the deeper pages as your next hands-on exercises.

AdTech Toolkit

Enter any two values
to calculate the third

More tools coming soon