ICT-App Dev Specialist FA key terms

A defined set of rules and endpoints that lets one software component request data or actions from another without knowing its internal implementation. APIs specify inputs, outputs, error codes, and authentication requirements.

A web service style that exposes resources at URLs and uses standard HTTP methods such as GET, POST, PUT, and DELETE. It is stateless, so each request carries all information needed to process it.

A specific URL path and method combination that an API exposes, such as a route for retrieving one record. Each endpoint has its own request format, response format, and access rules.

A lightweight text format for structured data using objects, arrays, strings, numbers, booleans, and null. It is the most common payload format for web APIs because it is readable and language-neutral.

A three-digit number in an HTTP response that summarizes the outcome, grouped as 2xx success, 3xx redirect, 4xx client error, and 5xx server error. Clients use it to decide whether to retry, surface an error, or continue.

A property where repeating the same request produces the same end state as sending it once. GET, PUT, and DELETE are typically idempotent, while POST usually is not, which matters for safe retries.

Converting an in-memory object into a format that can be stored or transmitted, such as JSON or binary. Deserialization reverses the process and must validate untrusted input to avoid crashes or injection flaws.

Verifying that a user or system is who it claims to be, typically through credentials, tokens, or certificates. It answers who you are, distinct from authorization, which decides what you may do.

Deciding which resources and actions an authenticated identity may access. Implementations range from role-based checks to attribute-based policies and must be enforced server-side, never only in the client interface.

A delegation framework that lets an application obtain limited access to a user's resources on another service without receiving the user's password. It issues access tokens through defined grant flows and scopes.

A compact, URL-safe token with a header, payload, and signature. The signature lets a server verify integrity, but the payload is only encoded, not encrypted, so sensitive data must not be placed there.

An access model that grants permissions to roles rather than individual users, and assigns users to roles. It simplifies administration and auditing because permission changes happen at the role level.

An injection flaw where untrusted input reaches a page and executes as script in a victim's browser. Preventing it requires context-aware output encoding, input validation, and a restrictive content security policy.

An attack that tricks a logged-in user's browser into sending an unwanted state-changing request to a site that trusts the user's cookies. Defenses include anti-CSRF tokens and SameSite cookie attributes.

Checking that incoming data matches expected type, length, format, and range before processing. It should be enforced on the server, with client-side checks treated only as a convenience for users.

An attack that inserts malicious SQL through unsanitized input so the database executes unintended commands. Parameterized queries and prepared statements are the primary defense against it.

A library that maps program objects to relational tables and translates operations into SQL. It reduces boilerplate but can hide inefficient queries, so developers still need to inspect generated statements.

A structured description of the entities an application stores, their attributes, and the relationships among them. It guides schema design, API payloads, and validation rules across the system.

A store that organizes data into tables of rows and columns linked by keys, queried with SQL. It enforces schema and constraints and provides transactions with atomicity and isolation guarantees.

A unit of work that guarantees atomicity, consistency, isolation, and durability. Either all its changes commit or none do, which protects data integrity when several related writes must succeed together.

An auxiliary data structure that speeds lookups on selected columns at the cost of extra storage and slower writes. Choosing indexes well requires understanding the queries an application actually runs.

The process of rewriting queries or adjusting indexes and schema so the database returns results with less work. Reading execution plans reveals whether scans, joins, or sorting dominate response time.

Storing frequently used results in a faster layer so repeated requests avoid slower computation or I/O. Effective caching needs clear expiry, invalidation rules, and tolerance for slightly stale data.

A geographically distributed network of servers that caches and serves static or cacheable content close to users. It reduces latency and origin load and can absorb traffic spikes and some attacks.

The time between a request and the corresponding response, often measured in milliseconds. Perceived performance depends on it, and network distance, server processing, and rendering all contribute.

The volume of work a system completes per unit of time, such as requests per second. It differs from latency, and a system can raise throughput while individual requests still respond slowly.

Distributing incoming traffic across several server instances so no single instance is overwhelmed. It supports horizontal scaling and can remove unhealthy instances from rotation automatically.

Adding more server instances to share load rather than upgrading one machine's capacity. It suits stateless services well and usually requires shared session storage or sticky routing.

A service that keeps no client session data between requests, so any instance can handle any request. This simplifies scaling, failover, and deployment because state lives in external stores.

An architecture that splits an application into small, independently deployable services communicating over a network. It improves team autonomy and scaling granularity but adds operational and consistency complexity.

A durable buffer that lets producers send work asynchronously while consumers process it later. It decouples services, smooths traffic spikes, and enables retries when a consumer fails.

A model where replicas may briefly disagree but converge once updates propagate. It trades immediate agreement for availability and scale, so applications must tolerate temporary stale reads.

A concurrency control that detects conflicting updates at write time, often by comparing a version number. It avoids long-held locks and suits low-contention data where conflicts are rare.

An automated test that exercises one small piece of logic in isolation, usually with dependencies replaced by fakes. Fast and focused tests give quick feedback when code changes.

A test that verifies several components working together, such as code against a real database or API. It catches wiring and contract problems that isolated unit tests cannot reveal.

A measure of how much code, branching, or behavior a test suite exercises. High coverage alone does not prove quality, since tests can execute lines without asserting correct outcomes.

Re-running relevant tests after a change to confirm existing behavior still works. Automated suites make it practical to repeat these checks on every build and before each release.

A practice where developers merge changes frequently and an automated pipeline builds and tests each one. It surfaces integration defects early and keeps the main branch releasable.

A practice that keeps software in a deployable state at all times, with an automated pipeline ready to release on demand. Deployment to production remains a deliberate human decision.

A release technique that runs two identical environments and switches traffic from the old to the new one. It enables fast rollback because the previous environment remains intact.

Gradually routing a small share of traffic to a new version while monitoring errors and metrics. If problems appear, traffic is shifted back before most users are affected.

A system that records changes to files over time so teams can review history, branch, and merge work. It enables parallel development and recovery from mistakes.

A structured peer examination of proposed changes before they merge. It catches defects, spreads knowledge, and enforces standards that automated tools cannot fully check.

The future cost of shortcuts taken now, such as rushed design or missing tests. Like financial debt, it accrues interest as changes become harder and should be repaid deliberately.

Restructuring existing code to improve readability or design without changing observable behavior. It is safest when backed by tests that confirm functionality remains intact.

A reusable, named solution to a recurring design problem, such as observer or factory. Patterns give teams shared vocabulary but should be applied only when the problem genuinely fits.

Supplying an object's collaborators from outside instead of letting it construct them. This loosens coupling, simplifies testing with substitutes, and makes configuration explicit.