Learn REST, GraphQL and HTTP Status Codes: A 108-Flashcard Study Plan

Most API flashcard decks stop at "GET reads, POST creates." APIs: REST, GraphQL & HTTP Status Codes (deck code YM3289, 108 cards) goes further: it is really two decks stitched together, and studying it that way saves a lot of reviews.

How the deck is built

• Cards 1-59 — API design. REST constraints, HTTP methods, URI naming, auth, caching, then a GraphQL block (cards 39-51) and a few neighbours: OpenAPI, webhooks, gRPC.
• Cards 60-108 — the status code reference. Classes 1xx-5xx, then individual codes from 100 Continue to 511 Network Authentication Required, plus non-standard ones (nginx 499, Cloudflare 520).

Cards worth knowing cold

What you'll cover

Statelessness, resources and representations, safe vs idempotent methods, PATCH vs PUT, plural collection names, nested resources, pagination (page/limit vs offset/limit), API versioning (URI, header, subdomain), content negotiation, Basic auth, Bearer tokens, OAuth 2.0, JWT, rate limiting vs throttling, CORS, GraphQL queries, mutations, subscriptions, schema/SDL, resolvers, fragments, aliases, introspection, OpenAPI/Swagger, webhooks, gRPC, Cache-Control, 201/204/206, 301/308, 303 See Other, 405, 409, 410, 413, 429, 451, 502/503/504, 418 I'm a teapot, and RFC 2616 → 7231 → 9110.

A study plan that fits the two halves

Learn the five class cards (61-65) before any individual code. Once "4xx = the client's fault, 5xx = the server's" is automatic, half of each code card is already answered. Then drill the three contrast cards (100-102: 401/403, 301/308, 302/307) — these are the pairs people actually mix up in interviews and code review.

Suspend the early duplicates. Cards 15-20 (400, 401, 403, 404, 500, 503) repeat cards 74-77, 89 and 92 almost word for word, and card 14 bundles 200/201/204, which cards 66-68 split cleanly. Cards 54 and 59 both define throttling vs rate limiting — keep 59, the comparison. That trims about eight cards with no loss.

Fix one gap while you're there. The method cards never say whether PATCH is idempotent. The answer is "not guaranteed" — a PATCH like "append to list" or "increment counter" isn't. Add it to card 10's back; it's a classic follow-up question to card 12.

Read the GraphQL error card twice. "Errors still return 200" means your monitoring can't rely on status codes alone for GraphQL — a useful contrast with the whole second half of this deck.

Keep going

Building the front end that calls these APIs? Pair this deck with JavaScript ES6+ Features (fetch, promises, async/await) and CSS Box Model, Selectors and Media Queries.

Find YM3289 — APIs: REST, GraphQL & HTTP Status Codes in the library on Flip It and start with the class cards.