What goes wrong repeatedly.
VERBS IN PATHS
An interface that reads as a list of functions rather than resources.
INCONSISTENT NAMING AND CASING
Callers guessing wrongly on every new endpoint.
NO PAGINATION
An endpoint that works until the data grows, then fails entirely.
RETURNING TWO HUNDRED WITH AN ERROR INSIDE
Monitoring that sees nothing wrong while everything fails.
ERROR MESSAGES CALLERS MUST PARSE
Integrations breaking when wording changes.
NO STABLE ERROR CODES
The same problem.
BREAKING CHANGES WITHOUT A VERSION
Callers failing with no explanation.
NO RATE LIMITS
One caller taking the service down.
SEQUENTIAL IDENTIFIERS EXPOSED
Enumeration, and volume disclosed.
MISSING OWNERSHIP CHECKS
The commonest serious breach: changing an identifier and reading someone else's data.
NO IDEMPOTENCY ON CREATION
Duplicate orders and payments after a timeout.
DATES WITHOUT TIME ZONES
Every caller interpreting them differently.
MONEY AS FLOATING POINT
Amounts that do not reconcile.
DOCUMENTATION THAT DOES NOT MATCH BEHAVIOUR
Trust lost at the first attempt.
NO SANDBOX
Callers developing against live data.
WHAT MOST OF THESE SHARE
They are cheap to prevent at design time and expensive afterwards.
