REST API for Beginners: Methods, Status Codes and JSON Explained (2026)

Here is an example to start with. A small bakery in Abbottabad has a website and a delivery app. When a customer opens the app, it quietly sends a message to the bakery's server: "give me today's cakes." The server replies with a neat list of names, prices and photos, and the app draws the menu. That short exchange is what a REST API does, and a guide to REST API for beginners is really a guide to the rules of that conversation.

The rules are few. Once you see them, almost every web app, mobile app and payment screen starts to make sense from the inside.

In this explainer, you will learn:

• What the word REST means and where it came from
• The five parts of every API request, in plain words
• What GET, POST, PUT, PATCH and DELETE do, and why "idempotent" matters
• The status codes that show up in almost every response
• How to write and test a tiny API with Express.js and Postman

What Is a REST API, in Plain Words?

API stands for Application Programming Interface. It's a set of agreed requests one program can send to another, with agreed replies. You don't need to know how the bakery's server stores its cakes. You only need to know which address to ask and what shape the answer will take.

REST is a style for designing those APIs over the web. In a REST API, everything you can work with is a resource: a product, an order, a student, a fee receipt. Each resource has its own address, called a URL. You act on it with standard HTTP methods, the same ones your browser already uses to load pages.

The reply usually comes back as JSON, a text format made of keys and values. A single cake might look like {"id": 7, "name": "Chocolate Fudge", "price": 1800}. Your frontend reads that and turns it into a card on the screen.

Where Did the Word REST Come From?

REST stands for Representational State Transfer. Roy Fielding described it in chapter 5 of his doctoral dissertation, published in 2000. He was writing about why the web itself scaled so well, and he summed it up as a set of constraints.

You don't need to memorize the theory, but the names come up in interviews. Here they are in short form:

1. Client-server: the screen and the data live in separate programs.
2. Stateless: every request carries everything the server needs. The server doesn't remember your last request.
3. Cache: replies say whether they can be stored and reused.
4. Uniform interface: resources are reached the same predictable way.
5. Layered system: a client can't tell if it's talking to the real server or a proxy in between.
6. Code-on-demand: the server may send code for the client to run. Fielding calls this one optional.

Any honest REST API for beginners lesson should admit this: most APIs you'll build as a junior developer follow these loosely, not perfectly. That's normal. When people say "RESTful," they usually mean "resource URLs, HTTP methods, JSON and sensible status codes."

The Five Parts of Every API Request

Think of this section as the mini glossary every REST API for beginners course should start with. Every request you send, from any tool, is built from these five pieces.

Endpoint

The full URL you call, such as https://api.example-bakery.pk/cakes/7. The base part points to the server. The path after it names the resource.

Method

The verb. It tells the server what you want to do with the resource: read it, create one, change it or remove it.

Headers

Extra details sent alongside the request. Two you'll meet early are Content-Type: application/json, which says you're sending JSON, and Authorization, which carries a login token.

Body

The data you send when creating or changing something. A GET request normally has no body. A POST that places an order does.

Response

What comes back: a three-digit status code, its own headers and, most of the time, a JSON body. Reading the status code first saves a lot of confused debugging.

HTTP Methods: What GET, POST, PUT, PATCH and DELETE Do

Five HTTP methods cover nearly all REST work. MDN's reference on request methods lists their definitions and two properties worth learning early: whether a method is safe (it doesn't change data) and whether it's idempotent (sending it twice leaves the server in the same state as sending it once).

A simple way to keep PUT and PATCH apart: PUT sends the whole cake record again, every field. PATCH sends only what changed, say the new price. Notice too that in MDN's table every safe method is also idempotent, so the risky corner is always a method that changes data.

Why Does Idempotent Matter on a Weak Connection?

Picture a customer on patchy mobile data who taps "Place order." The request reaches the server, but the reply gets lost on the way back. The app doesn't know if the order went through, so it tries again.

If that retry is a DELETE or a PUT, nothing bad happens. The cake is still deleted, or the record still holds the same values. If it's a POST, the bakery may now have two orders and an annoyed customer. That's why careful developers guard POST endpoints, for example by checking for a duplicate order before saving a new one. Knowing which methods are idempotent tells you where those guards are needed.

HTTP Status Codes You'll Read Every Day

Every response starts with a three-digit code. MDN's status code reference groups them into five classes by their first digit: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. The first digit alone tells you whose side the problem is on.

The 401 vs 403 difference is a favorite interview question. Remember it as "who are you?" versus "I know who you are, and you can't come in."

Designing Clean Endpoints: Nouns, Not Verbs

Beginners often name URLs after actions: /getAllCakes, /createOrder, /deleteCake?id=7. It works, but it repeats what the method already says and gets messy fast.

RESTful design keeps the URL for the noun and lets the method carry the verb. A few habits to build from your first project:

• Use plural nouns for collections: /cakes, /orders.
• Put the ID in the path for one item: /cakes/7.
• Nest only when the relationship is real: /orders/42/items.
• Use query strings for filters and pages: /cakes?category=birthday&page=2.
• Stick to lowercase and hyphens: /gift-boxes, not /GiftBoxes.
• Add a version at the start if the API will be used by others: /v1/cakes.

None of these are laws. They are conventions that make your API easy for the next developer to guess, and that next developer is often you, three months later.

A Tiny Express.js API You Can Read in Two Minutes

Express is the framework most MERN courses use for the backend. According to the Express team's March 2025 release post, version 5.1.0 became the latest tag on npm, so a fresh npm install express now gives you Express 5. The code below uses an in-memory array instead of a database, so you can focus on the API shape.

const express = require("express");
const app = express();
app.use(express.json());

let cakes = [{ id: 1, name: "Chocolate Fudge", price: 1800 }];

app.get("/cakes", (req, res) => {
  res.json(cakes);
});

app.get("/cakes/:id", (req, res) => {
  const cake = cakes.find(c => c.id === Number(req.params.id));
  if (!cake) return res.status(404).json({ error: "Cake not found" });
  res.json(cake);
});

app.post("/cakes", (req, res) => {
  const { name, price } = req.body;
  if (!name || price <= 0) return res.status(422).json({ error: "Name and a positive price are required" });
  const cake = { id: cakes.length + 1, name, price };
  cakes.push(cake);
  res.status(201).json(cake);
});

app.delete("/cakes/:id", (req, res) => {
  cakes = cakes.filter(c => c.id !== Number(req.params.id));
  res.status(204).end();
});

app.listen(3000);

Read it slowly and you'll spot everything from the earlier sections: plural noun URLs, an ID in the path, JSON in and out, and a different status code for each outcome. In a real project, the array becomes a MongoDB collection or a MySQL table, and the POST route checks the user's login token first.

How Do You Test an API Without a Frontend?

You don't need React to try your API. Three tools cover almost everything a beginner needs:

1. Your browser: open http://localhost:3000/cakes and you'll see the JSON. This only works for GET requests.
2. The Network tab in DevTools: press F12 on any website, reload, and watch the real API calls, their methods and status codes. It's the fastest way to learn from apps you already use.
3. Postman or a similar API client: pick a method, type the URL, add a JSON body and press Send. Save requests into a collection so you can rerun them after every change.

Postman is widely used at work too. The company's 2025 State of the API announcement says the platform has more than 40 million users. The same survey of over 5,700 developers found that 24.3% are already designing APIs with AI agents in mind, which tells you APIs are becoming more central, not less.

REST API for Beginners: Mistakes to Avoid Early

These come up again and again when students build their first backend:

• Sending 200 for everything. If the cake doesn't exist, return 404. A frontend can't react properly to an error dressed up as success.
• Using GET to change data. A link like /cakes/7/delete can be triggered by a crawler or a preview bot. Use DELETE.
• Trusting the request body. Always check types and required fields on the server, even if the form already checks them.
• Leaking error details. A 500 reply should not show the database password or a full stack trace to the public.
• Putting secrets in the URL. Tokens in query strings end up in server logs and browser history. Send them in the Authorization header.
• Skipping documentation. Even a short README listing each endpoint, its method and an example reply saves your teammates hours.

Why REST API Skills Show Up in Pakistani Job Ads

Open almost any junior web developer listing and you'll find APIs in the requirements. A current Devsinc MERN software engineer opening in Islamabad, for example, asks for familiarity with RESTful APIs and third-party API integrations, alongside React, Node.js, Express and MongoDB, and lists building RESTful APIs among the duties.

The global picture points the same way. In the 2025 Stack Overflow Developer Survey, 48.7% of all respondents reported using Node.js and 19.9% reported using Express. Among databases, PostgreSQL led at 55.6%, with MySQL at 40.5% and MongoDB at 24%. Whichever database a company picks, the frontend still talks to it through an API.

Much of Pakistan's tech work is also done for clients abroad. Business Recorder, citing State Bank of Pakistan data, reported IT and telecom export remittances of about $4.6 billion in FY2025-26, up from $3.814 billion the year before. Foreign clients expect clean, documented APIs, so this is one skill that travels well between local jobs and freelance work.

If you want to see how these skills affect pay, our full stack developer salary report lays out the public data. And if you are still choosing a backend language, the PHP vs Node.js comparison covers that decision.

Practicing APIs in PSTA's Full-Stack Course

REST APIs are a full module in the Full-Stack Web Development Course with AI Tools. Module 4 covers Node.js, Express.js and RESTful API design, and Module 5 connects those routes to MongoDB with Mongoose and to MySQL. One of the course projects is a REST API with user registration, login and CRUD routes backed by MongoDB, and the capstone is a deployed MERN app.

The course runs for six months and suits complete beginners. The course page currently lists the fee as Rs. 45,000, down from the regular Rs. 60,000, and you can split it into two installments. You can join on campus at Mandian, Old College Road, opposite FIMS College, Abbottabad, attend the same classes live online from any city, or mix both. A new batch starts every month.

If JavaScript itself still feels shaky, start with the JavaScript Programming Course and our guide to async/await in JavaScript, since every API call you make from the frontend depends on it. Python learners can build the same kind of API in the Advanced Python course. You can browse all PSTA courses or go straight to the admission form, and questions about timings are answered on WhatsApp at +92 314 5424399.

Build Your First Endpoint Tonight

The quickest REST API for beginners exercise is one you run yourself. Install Node.js, create a folder, run npm init -y and npm install express, then type the small example above by hand rather than pasting it. Start the server, open Postman and send a GET, a POST with a JSON body, a POST with a negative price and a DELETE. Write down the status code you got for each one. If all four match what you expected, you understand more about REST APIs than most people who have only read about them. Push the folder to GitHub with our Git commands guide and you have the first piece of a backend portfolio.