Python & APIs
Building robust HTTP APIs: validation, error handling, status codes, the engineering spine.
HTTP APIs
An HTTP API exposes endpoints (URLs) that accept requests (method + body + headers) and return responses (status code + body). For AI engineering, your API is the boundary between your model code and the world — every LLM call, RAG query, and agent action flows through it. Get it right and everything downstream is easier.
Why this matters for AI engineers
Every LLM application is, at its core, an HTTP API. The model call, the streaming response, the tool execution — all flow through HTTP. Engineers who skip this build fragile AI services that crash on bad input, leak errors to users, and can't scale. Master the API first; AI is built on top.
API architecture
Client → POST /api/endpoint with JSON body → server validates (Pydantic) → executes → returns JSON with correct status code (200/201/400/422/500). Errors are structured (not stack traces). Streaming uses SSE. Auth via bearer token. Rate limiting at the gateway.
A production-grade endpoint
from fastapi import FastAPI
app = FastAPI()
@app.post("/api/echo")
def echo(req):
return {"echoed": req["message"].upper()}
# Problems: no validation, no error handling, no status codes, crashes on bad inputExperiment: status codes
Match scenarios to the correct HTTP status code.
What to observe
Status codes communicate intent. 2xx success, 4xx client error (bad request, auth, not found, validation), 5xx server error. Use 422 (not 400) for semantic validation failures. Always include a Retry-After header on 429. Never leak stack traces to clients — log internally, return generic message.
Production APIs
Production APIs: Pydantic validation on input AND output, structured error responses (not stack traces), request logging middleware, rate limiting, auth, OpenAPI docs auto-generated, versioning (/v1/...), health check endpoint, graceful shutdown, and observability (latency, error rate per endpoint).
Challenge
Design a POST /api/llm/chat endpoint that: validates the message, enforces a per-user rate limit, streams the response via SSE, logs the request, and returns proper status codes for each failure mode.
Production checklist
Production checklist
0 of 10 checked
Knowledge check
A client sends a POST with a missing required field. What status code?
Complete
You can now build production HTTP APIs. Next: data and databases — SQL, schemas, indexing.
Mark this chapter as complete
Track your progress and unlock the next chapter.