ArcGIS Developer Foundation cheat sheet

ArcGIS REST API is the base layer: every service (Feature, Map, Image, Geometry, Geocoding) is exposed as REST resources with JSON responses, and every SDK ultimately calls these endpoints via HTTPS.

Authentication options: API key (sent as token query parameter, scoped to services and referrer/IP restrictions), OAuth 2.0 user login (authorization code flow for browser apps, PKCE for public clients), and ArcGIS identity for organization members; tokens expire and must be refreshed.

Portal item model: everything in ArcGIS Online or Enterprise is an item with an item ID, type (Web Map, Feature Service, Layer, Web App), owner, and sharing level (private, group, org, public); developers reference items by item ID rather than URL where possible.

Feature Service query parameters that matter: where, outFields, returnGeometry, geometry + spatialRel, orderByFields, resultOffset/resultRecordCount (pagination), f=json, and returnCountOnly for counts.

Geometry engine: client-side operations (buffer, intersect, union, distance, project) exist in each SDK's geometry module; use geodesic variants for large distances or near-polar coordinates, planar variants for local projected data.

Coordinate systems: services declare spatialReference (WKID); requests without an explicit outSR return data in the service's native SR, so always set outSR when mixing layers with different WKIDs.

Editing workflow: applyEdits on a feature layer takes adds, updates, deletes arrays; updates require the objectId and attributes; rollbackOnFailure controls atomicity; features include geometry in the service's spatial reference unless the layer supports a different input SR.

Rate limits and quotas apply to API keys and named users (e.g., geocoding, routing, storage credits); 429 responses require exponential backoff, and batch operations should be chunked to stay within request limits.

ArcGIS Maps SDK for JavaScript 4.x uses a modular AMD or ES-module import style (import Map from '@arcgis/core/Map'); 3.x is legacy and uses a different widget/API surface.

WebMap and WebScene are loaded from portal item IDs (esri/views/MapView and SceneView); the view handles rendering, extent, and popups, while the map holds layers and basemap.

Layer types: FeatureLayer (vector features from a feature service), MapImageLayer (server-rendered sublayers), TileLayer/VectorTileLayer (cached tiles), GraphicsLayer (client-side graphics), ImageryLayer, and CSVLayer/GeoJSONLayer for file-based data.

Popups are configured via popupTemplate with content functions or fieldInfos; the view's hitTest and popup APIs let you inspect features under a pointer.

Widgets are constructed with a view reference (e.g., new Search({view})) and added to view.ui; the ui positions are strings like 'top-right' and can hold custom DOM elements.

ArcGIS Maps SDK for Python (arcgis package) wraps the REST API: GIS('https://www.arcgis.com', api_key=...) authenticates, then gis.content.get(item_id) returns an Item whose layers expose query() and edit_features().

ArcGIS Maps SDK for .NET and Qt follow the same object model (Map, MapView, layers, graphics) and support offline workflows via mobile map packages and geodatabases.

ArcGIS Runtime/SDK localization and licensing: Lite, Basic, Standard, Advanced license levels unlock specific capabilities (e.g., offline editing, analysis), and deployment requires a license string or named-user login.

ArcGIS REST API supports f=json and f=pjson (pretty JSON); f=html returns an HTML page for browser inspection; error responses include an error object with code and message.

Paging large query results: use resultOffset and resultRecordCount with orderByFields set to a unique field (usually the objectId) to get stable pages; exceededTransferLimit in the response signals more records.

Spatial queries: geometry can be a point, envelope, or polygon; spatialRel values include esriSpatialRelIntersects, esriSpatialRelContains, esriSpatialRelWithin, and esriSpatialRelEnvelopeIntersects.

Statistics queries: outStatistics is a JSON array of {statisticType, onStatisticField, outStatisticFieldName}; groupByFieldsForStatistics groups results; statisticType values include count, sum, avg, min, max, stddev, and var.

Editing via REST: POST to /applyEdits with adds, updates, and deletes as JSON arrays; the response reports addResults, updateResults, and deleteResults with success flags and objectIds.

Geocoding service endpoints: findAddressCandidates (forward), reverseGeocode (reverse), suggest (autocomplete); each consumes geocoding credits per request.

Routing service endpoints: solve (route with stops and barriers), closestFacility, serviceArea, and originDestinationCostMatrix; travel mode and impedance determine cost calculations.

Service metadata: GET the service root with f=json to list layers, tables, supported operations, maxRecordCount, and capabilities (Query, Editing, Sync, Extract) before writing client code.

ArcGIS Enterprise vs ArcGIS Online: same REST surface, but Enterprise URLs are /arcgis/rest/services on your portal host; authentication uses portal tokens or IWA/OAuth, and federated servers share the portal's identity store.

API key restrictions: keys can be limited to specific referrers (web) or IP ranges (server), scoped to services (e.g., basemaps, geocoding, routing), and rotated; keys do not carry user identity, so secured org content is not accessible.

OAuth 2.0 flow: register an app in the portal to get client_id and redirect_uri, redirect the user to /sharing/rest/oauth2/authorize, exchange the code at /oauth2/token for an access_token with a referer, then call services with token=...

CORS: ArcGIS services support cross-origin requests; for self-hosted Enterprise behind a proxy, configure the proxy and use esriConfig.request.proxyUrl (JS SDK) or equivalent so requests route correctly.

Webhooks and events: ArcGIS Enterprise supports portal webhooks for item/user events; ArcGIS Online offers webhooks for item changes, and feature service change tracking (syncEnabled, editor tracking fields) supports incremental sync.

Offline workflows: generate offline packages (mobile map package, mobile geodatabase) via the offline packaging service, sync edits with the Sync capability, and design layers with syncEnabled=true and globalIds.

Version management: feature services can be versioned (branch versioning) for long transactions; developers must pass gdbVersion in query/applyEdits requests when working against a named version.

Testing and CI: use the REST API directly for contract tests, mock tokens with a test portal, and pin SDK versions because minor releases occasionally deprecate widget or module paths.

Basemap styles service: basemap styles are requested by style name (e.g., arcgis/streets, arcgis/imagery) and require an API key or token; the SDKs' Basemap.fromId or BasemapStyle enum maps to these.

Geoprocessing services: submit jobs via /GPServer//submitJob, poll /jobs/ for status (esriJobSucceeded, esriJobFailed), then fetch results from /results/; use synchronous execute for fast tasks.

ArcGIS Location Platform: the cloud developer platform provides services (basemaps, geocoding, routing, spatial analysis) billed by usage; authentication uses API keys scoped to specific services.

Spatial analysis services: overlay (intersect, union, erase), summarizeWithin/summarizeNearby, density, hot spot analysis, and proximity tools are exposed as REST tasks and consume credits per feature processed.

Client-side vs server-side decision: use client-side query/geometry for small datasets and responsiveness; use server-side analysis or SQL for large datasets, joins, and aggregation beyond maxRecordCount.

Data formats: GeoJSON, CSV, shapefile, and file geodatabase can be published as hosted layers via the portal's publish API; GeoJSON is consumed directly by GeoJSONLayer in the JS SDK.

Security best practices: never embed long-lived admin tokens in client code; use short-lived tokens, restrict API keys, and proxy requests through a server when secrets are required.

Error handling: REST errors return HTTP 200 with an error body in some cases, so always inspect the JSON error field rather than relying on status codes alone.