API checklist

[whymarrh]

• Documentation
• SSL
• Rate limiting
• Blacklisting (or revoking access more generally)
• API versioning via the Accept header
• Resource representation negotiation (via Accept and Content-Type)
• Gzip (or data compression more generally)
• Pagination via Link headers
• Custom error messages with defined HTTP status codes
• Authentication
• JSON as a hypermedia via HAL (or a custom media type)

[whymarrh]

Checked: Authentication

Basic auth over SSL.

[whymarrh]

Error messages w/ defined HTTP status codes, API versioning via the Accept header, content negotiation are handled by Rested.