API Design
REST, GraphQL, gRPC, OpenAPI, idempotency and versioning — designing APIs that survive scale and change.
8 articlesin API Design
API Gateways in 2026: YARP, Azure APIM, and the AI Gateway Pattern
YARP for in-process east-west traffic, Azure APIM north-south with policies for auth + rate limit + transform, BFF per channel, defense in depth, and the 2026 AI Gateway: token caps + semantic cache + token metrics.
OpenAPI 3.1 on .NET 9: Built-in Spec, Scalar UI, and Kiota Clients
Microsoft.AspNetCore.OpenApi replacing Swashbuckle, OpenAPI 3.1 with JSON Schema 2020-12, Scalar / Redoc UIs, schema + document transformers, Kiota / NSwag SDK generation, Spectral lint + oasdiff in CI.
Rate Limiting on .NET 9: Token Buckets, Redis, and Tiered Policies
Built-in RateLimiter middleware with FixedWindow/SlidingWindow/TokenBucket/Concurrency, partition by user/API key, distributed counters with Redis Lua INCR/EXPIRE, 429 + Retry-After + RateLimit-* headers, layered with APIM.
API Versioning: URL, Header, Media Type, and Sunset Discipline
Asp.Versioning 8 on .NET 9, URL/query/header/media-type schemes, additive evolution, one domain with multiple wire mappers, RFC 8594 Sunset + Deprecation headers, per-version OpenAPI documents.
WebSockets and SignalR: Heartbeats, Backplanes, and CSWSH Defense
WebSocket vs SignalR vs SSE vs WebTransport, .NET 9 SignalR Hub + MapHub, scale-out with Redis backplane or Azure SignalR Service, KeepAliveInterval heartbeats, JWT in query string, backpressure with Channels.
gRPC on .NET 9: HTTP/3, Streaming, Deadlines, and JSON Transcoding
Four call patterns (unary/server/client/bidi), .NET 9 server + strongly-typed client over HTTP/3, deadlines + ServiceConfig retry policies, gRPC-Web for browsers, JSON transcoding so one service speaks gRPC and REST.
GraphQL with HotChocolate 14: Projections, DataLoaders, and Federation
When GraphQL beats REST and when it does not, HotChocolate 14 on .NET 9 with [UseProjection] + source-generated DataLoaders, persisted operations, cost analysis, Apollo Federation v2 with @key fields.
REST Principles in 2026: Resources, Idempotency, and Problem Details
The five constraints that still matter (resources, methods, status codes, statelessness, cacheability), idempotency keys, RFC 9457 problem+json, cursor pagination over OFFSET, ETags + 304s, ASP.NET Core 9 MapGroup.