HTTP messages means the data that is exchanged between a server and a client. There are two types of messages:

1. requests: sent by the client to trigger an action on the server
2. responses: the answer from the server to the client

Http message includes allways headers and it can also include a body. You can find a list of http headers from https://tools.ietf.org/html/rfc4229.

In REST API we can use these Http methods:

• POST (to add data)
• GET (to show data)
• PUT (to update data)
• DELETE (to remove data)

When you are making a REST API, it is important to know that when you are using GET-method, you have to insert the data inside the header and when you are using POST-method, you have to insert the data inside the body.

Example if you want to send a variable named fname, with a value Jim using GET-method, then the url will be something like
http://localhost/api/?fname='Jim'
But if you are using POST-method then, the url is just like this
http://localhost/api

When we are using DELETE, we will add the id to the url on the same way as in GET-method. And when we are using PUT, we will add the id to the url and the update data to the body.

A common way to build a REST API is that, you don't have to include the variable names in your GET-requests. So that instead of this kind of url
http://localhost/api/?id=5
you can just type
http://localhost/api/5

You can read more about those methods from:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods
http://www.restapitutorial.com/lessons/httpmethods.html

The http response includes status code, which gives information about the response. The most important classes of the codes are:

• 200 - 299 : Success
• 400 - 499 : Client errors
• 500 - 599 : Server error

You can read about the status codes from:
https://www.restapitutorial.com/httpstatuscodes.html

HTTPS(Hypertext Transfer Protocol Secure) is an extension for the HTTP. If you use HTTP, all the information will be transfered in plain text format. But if you use HTTPS, the information will be encrypted.

Authorization is one of the fields in http headers. There are several authorization types and in the examples of this website I am describing http Basic-authorization and Webtoken-authorization.

Using authorization means that we will protect our REST API (or some routes in the API) with username and password. And then the client will have to send the right credentials: username and password inside the http headers. If the client don't send valid the credentials, the server will response 401 Unathorized.

JSON objects are written inside curly brackets. Example like this

{
	"id_book": 11,
	"name": "New Book",
	"author": "Mike",
	"isbn": "22"
}

JSON arrays are written inside square brackets. And the array can contain objects. Like this

[
	{
		"id_book": 11,
		"name": "New Book",
		"author": "Mike",
		"isbn": "22"
	},
	{
		"id_book": 7,
		"name": "Signal Slot",
		"author": "Jim Bim",
		"isbn": "2345-66"
	}
]

The purpose of authentication is to verify that someone or something is who or what they claim to be.

Authorization is the security process that determines a user or service's level of access. In technology, we use authorization to give users or services permission to access some data or perform a particular action.

In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a username and password when making a request. In basic HTTP authentication, a request contains a header field in the form of Authorization: Basic <credentials>, where credentials is the Base64 encoding of ID and password joined by a single colon :.

JWTs or JSON Web Tokens are most commonly used to identify an authenticated user. JWT authentication follows a 4 step process:

1. Client sends post request with credentials to auth server to authenticate themselves
2. Server authenticates user credential and generates a JWT. Server does not store anything and sends the token to the browser to save. It allows users to authenticate without their credentials in the future
3. Then for every request the client sends the JWT in the authorization header. Validation happens using token introspection with the server.
4. Once validated, server sends the necessary data to the client.