How can you ensure your API development framework is both scalable and maintainable?

Although chosing a framework is important, most frameworks will provide the nessesary functionality. Be sure to use a modern framework and not a legacy framework. You want to be sure the framework you choose is wildly adopted and almost anyone can jump in and make changes. You want to be sure that your REST services can easily be deployed to the cloud and supported by the infrastructure. Be sure you can easily adapt to security requirements and switch between evolving authentication methods (password to OAUTH and others). You always want to consider the ease of use and reuse of the code. Consider the environment it will be deployed in and any future environment it may be deployed in.

I completely agree with this. I think one thing that the REST principals fails to mention is security. It's such a critical component of any REST API (or any endpoint that communicated with another over HTTP). I understand why security doesn't fall under any of the categories but I think it should be mentioned. The definition of REST is well defined and even without security you can still have a REST service. I would add a small note saying "Although security is not part of the four categories used to define REST, it is a critical aspect of REST that should be a part of any discussion about REST".

API Documentation is key, but it’s also hard to maintain. Using a tool like Swagger to automate the generation of API documentation is crucial. An outdated documentation is of no use. Also, remember to keep your code self-documented. Write your code in a way that other collaborators, including non-technical ones, can understand it.

I couldn't have said it better myself. One of the greatest benefits of this practice is the versioning that was mentioned. This is your greatest ally in mission critical systems. Being a to support legacy systems and newer changes is a practice that is required.

When constructing an API, it is crucial to integrate security as a core aspect from the outset. Include this principle in your team's starter pack or quick start guide: Security is not merely an additional feature, but the fundamental weave of your platform's fabric. Impress upon your team that effective security measures are designed and built in, not merely appended, ensuring a robust and secure foundation for all functionalities. This proactive approach is key to maintaining the integrity and trustworthiness of your services.

Beyond the functionality of the API, this is the single most important aspect of your REST development. You should consider this as one of the highest priorities in developing the requirements and ensure your scans check for this. It cannot be overstated how important this is. All data over the network should use authentication. Always.

I think at this point of authentication and authorization you can develop your ways and methodology, of using JSON Web Token, how to use it and reuse it and how to save it, and of course, through secure connections...

It's an excellent practice but in the real world, all of this is not always doable. Optimization and async behavior should be part of your code review and captured. These are very important. I'm not sure why filtering and sorting is specified. When accessing data from an API, I never assume the data is filtered and sorted. If the filtering and sorting is at a determent to the API then I would avoid it. It's more important to send the data.

You can use another database to Increase the performance of your API such as Redis cache, SW cache, and indexing but in "suitable ways"...

Optimisation should be done after defining SLAs and key metrics for your API, and forecasting their growth in the mid-term. There is no need to over-optimise an API that is forecasted to see only a 1000 requests per day for the next one year. Know your business requirements, keep track of them and if needed, then optimise.