2.A Parcel Through the Sorting Office

The Problem in Real Life

"The App Calls the Server" vs. Every Step in Between

REST APIs and the Request/Response Lifecycle

• REST, quickly (Act 12): a REST API organises everything as resources with addresses (/v1/orders, /v1/orders/1042) and uses HTTP methods as verbs: GET reads, POST creates, PUT/PATCH updates, DELETE removes. Data travels as JSON. Each request carries everything needed to handle it (stateless).
• 1. The client builds the request: method (POST), URL (https://api.blueticket.example/v1/orders), headers (Authorization, Content-Type: application/json) and a body — the JSON with the seats and the event.
• 2. The network (Acts 11, 12, 19): DNS finds the address, TLS encrypts the connection, the load balancer picks a healthy server.
• 3. Routing — which desk handles it: the server's router matches POST /v1/orders to the right piece of code (a handler, or controller).
• 4. Middleware — the checking stations: before the handler runs, the request passes through middleware: small layers that each do one check. Is there a valid token (authentication, Act 22)? Too many requests from this client (rate limit)? Is the JSON well-formed? Is it logged with a request ID (Act 17) so it can be traced? Any station can stop the request with an error.
• 5. Validation and authorization: the handler checks the body — are the seat IDs real, is the quantity 1–6? — and whether this user may do this (Act 22).
• 6. Business logic and data: the actual work: hold the seats in a transaction (Act 13), calculate the price, create the order in the database, maybe put a message on a queue (Act 14).
• 7. The response — the delivery receipt: the server sends back a status code (201 Created), headers, and a JSON body describing the result: the new order's ID, total and status. The client reads the status code first, then the body.

POST /v1/orders HTTP/1.1
Host: api.blueticket.example
Authorization: Bearer eyJhbGciOi...
Content-Type: application/json

{ "eventId": "evt_311", "seatIds": ["C14", "C15"] }

--- response ---

HTTP/1.1 201 Created
Content-Type: application/json
X-Request-Id: req_9f2a71

{ "orderId": "ord_1042", "status": "awaiting_payment", "total": 178.00, "holdExpiresAt": "2026-11-20T19:57:00Z" }