标签：#API

كل مقال رئيسي عن إطلاق Claude Opus 5 في 24 يوليو 2026 ذكر الميزة نفسها: التبديل بين التكلفة والقدرة. لكن معظم التغطية لم تشرح ما هي المستويات، أو ما الذي يتغير عند تبديلها، أو أثرها على الفاتورة. جرّب Apidog اليوم الميزة هي معلمة طلب باسم effort تضم خمسة مستويات في Opus 5، وقيمتها الافتراضية هي high . أعادت Anthropic معايرة هذه المستويات لهذا النموذج، لذلك لا تنقل إعدادات Opus 4.8 كما هي. كذلك، تؤدي مجموعة محددة من الإعدادات إلى خطأ 400 شائع أثناء الترحيل. 💡 إذا أردت اختبار المستويات مقابل نقطة نهاية حقيقية، استخدم Apidog لإرسال الطلب نفسه بخمسة إعدادات مختلفة ومقارنة النتائج. ما هي معلمة الجهد ( effort )؟ توجد effort داخل كائن output_config في طلب Messages API: { "model" : "claude-opus-5" , "max_tokens" : 8192 , "output_config" : { "effort" : "high" }, "messages" : [ { "role" : "user" , "content" : "Refactor this module and explain the tradeoffs." } ] } تتحكم المعلمة في مقدار التفكير الداخلي الذي يجريه النموذج قبل إنشاء الإجابة. يعمل Opus 5 بالتفكير التكيفي افتراضيًا، وتحدد effort حجم ميزانية التفكير: جهد أعلى: رموز تفكير أكثر، تكلفة أعلى، وزمن استجابة أطول. جهد أقل: رموز تفكير أقل، تكلفة أقل، وزمن استجابة أقصر. تعرض واجهات المستخدم هذه الفكرة كمحدد للجهد، لكن عند استخدام API فإن output_config.effort هي القيمة التي تتحكم بها فعليًا. راجع دليل واجهة برمجة تطبيقات Opus 5 للحصول على شكل الطلب الكامل، وراجع نظرة Anthropic العامة على النماذج للمرجع الرسمي للمعلمات. ما الذي لا تتحكم به effort ؟ لا تتحكم effort في إسهاب الإجابة أو طول النص المرئي. وفق دليل توجيه Anthropic لـ Opus 5 ، خفض الجهد يقلل التفكير الداخلي، وليس طول الإجابة. إذا أردت استجابة أقصر، اطلب ذلك صراحةً في التوجيه: أجب في خمس نقاط فقط، ولا تضف مقدمة أو شرحًا إضافيًا. لن يؤدي ضبط effort على low وحده إلى تقصير الإجابة. المستويات الخمسة المستوى ماذا يفعل الاستخدام النموذجي low أدنى مقدار من التفكير قبل الإجابة التصنيف واسع النطاق، الاستخراج، التوجيه، الملخصات القصيرة medium تفكير معتدل أسئلة وأجوبة مع سياق مسترجع، تعديلات ملف واحد، تحويلات منظمة high القيمة الافتراضية. تفكير كبير مهام عامة عندما لم تجرِ قيا

Todo artigo principal sobre o lançamento do Claude Opus 5 em 24 de julho de 2026 destacou a mesma funcionalidade: uma forma de alternar entre custo e capacidade. Mas poucos explicaram o que ela controla, quais níveis existem, como afeta a requisição ou o impacto na conta. Experimente o Apidog hoje Essa funcionalidade é o parâmetro effort . No Opus 5, ele tem cinco níveis e o padrão é high . A Anthropic recalibrou esses níveis para o modelo, então configurações ajustadas no Opus 4.8 não devem ser reutilizadas sem avaliação. Além disso, uma combinação específica de parâmetros gera erro 400 durante migrações. 💡 Para comparar os cinco níveis contra um endpoint real, envie a mesma requisição com valores diferentes de effort e registre custo, latência e qualidade da resposta. O que o parâmetro effort realmente faz O effort fica dentro de output_config em uma requisição para a API de Mensagens: { "model" : "claude-opus-5" , "max_tokens" : 8192 , "output_config" : { "effort" : "high" }, "messages" : [ { "role" : "user" , "content" : "Refatorar este módulo e explicar os trade-offs." } ] } Ele controla quanto raciocínio interno o modelo executa antes de responder. No Opus 5, o pensamento adaptativo está ativado por padrão. O valor de effort define o orçamento usado nesse raciocínio: effort mais alto: mais tokens de raciocínio, maior custo e maior latência. effort mais baixo: menos tokens de raciocínio, menor custo e menor latência. Nas interfaces de consumidor, a mesma opção pode aparecer como um seletor entre custo e capacidade. Na API, o controle efetivo é o campo output_config.effort . Consulte o formato completo da requisição no guia da API do Opus 5 e a documentação da Anthropic na visão geral de modelos . effort não controla verbosidade effort não é um controle de tamanho da resposta. Segundo o guia de prompting da Anthropic para o Opus 5 , reduzir o effort diminui o raciocínio interno, não o comprimento do texto visível. Se você precisa de respostas curtas, inclua essa

When you scrape at any real volume, the bottleneck is rarely your code — it's the target site's rate limiting and IP bans. Rotating residential proxies solve this by routing each request through a different real-user IP. Here's how to wire them into requests and Scrapy in Python, including the sticky-session trick most tutorials skip. The proxy URL format A residential proxy is just an authenticated HTTP/SOCKS endpoint. With a pool gateway, you target a country and control session behavior through the username , not separate endpoints: http://USERNAME_country-us_session-a1b2c3_lifetime-30:PASSWORD@proxy.gproxy.net:1000 country-us — exit country (ISO code) session-a1b2c3 — a sticky-session id; reuse it to keep the same IP , change it to rotate lifetime-30 — how many minutes that session's IP stays fixed Basic request through a rotating proxy import requests USER = " USERNAME " PWD = " PASSWORD " def proxy ( country = " us " , session = None , lifetime = 30 ): tag = f " _country- { country } " if session : tag += f " _session- { session } _lifetime- { lifetime } " url = f " http:// { USER }{ tag } : { PWD } @proxy.gproxy.net:1000 " return { " http " : url , " https " : url } # New IP on every call (no session id): r = requests . get ( " https://api.ipify.org?format=json " , proxies = proxy (), timeout = 30 ) print ( r . json ()[ " ip " ]) Run it in a loop and you'll see a different IP each time — the gateway rotates automatically when no session id is present. Sticky sessions: keep one IP across requests Some flows (login, multi-step checkouts, paginated results behind a cookie) break if your IP changes mid-session. Pin the IP by passing a stable session id: import uuid sess = uuid . uuid4 (). hex [: 8 ] # one id for the whole flow p = proxy ( country = " de " , session = sess , lifetime = 30 ) s = requests . Session () s . proxies . update ( p ) s . get ( " https://example.com/login " ) s . post ( " https://example.com/login " , data = {...}) # same exit IP When you

The data isn't the hard part. Cleaning it is. SEC EDGAR is public, free, and a mess. Every quarter, 13,000+ institutional investment managers file Form 13F, disclosing their U.S. equity holdings. In theory that's a beautiful dataset — every hedge fund, every pension fund, every bank, all in one place. In practice, the raw filings actively fight you: The same institution files under different names, sometimes even in the same quarter. In our own database right now: BlackRock, Inc. and BlackRock Inc. are two distinct CIK registrations for what most people would call "one" institution. Multiply that across 13,000+ filers and you get a long tail of near-duplicate names that break any naive GROUP BY institution_name . CUSIPs don't map cleanly to tickers. Foreign issuers frequently use CUSIP prefixes that don't resolve through the usual reference data — we ended up building a fallback resolution path (Yahoo Finance lookups plus manual validation rules) just to keep ticker coverage from silently degrading over time. Quarters arrive gradually, not all at once. The SEC gives managers up to 45 days after quarter-end to file. If you naively take "the latest quarter with any data" as your reporting period, you'll rank a barely-started quarter — where only a handful of small filers have reported so far — ahead of the real, complete prior quarter. We learned this the hard way: an unclamped "most recent quarter" query once let 115 newly-onboarded institutions' entire existing portfolios get counted as "new inflow" with nothing to offset them, because a first-time filer has no prior-quarter row to diff against. That's the kind of bug that doesn't throw an error — it just quietly produces a chart that looks plausible and is wrong. Amendments (13F-A) revise, replace, or partially restate earlier filings , and the XML schema itself has shifted over the years, so parsing "just the latest 13F" isn't a fixed target. None of this is exotic — it's the normal cost of working with real-world

When you're building a multi-tenant SaaS, the first architectural question is usually: how do you keep tenant data isolated? The options range from separate databases per tenant (maximum isolation, maximum cost) to a shared database with row-level filtering (minimum cost, more careful coding required). But there's an equally important question that gets less attention: how does your API know which tenant context a request belongs to? This post covers a pattern we've used in production: a custom request header for tenant scoping, combined with JWT authentication. Simple to implement, easy to audit, and flexible enough to support multi-tenant access from a single user account. The Three Common Approaches 1. Subdomain-based ( tenant.yourdomain.com ) The tenant is encoded in the hostname. Each subdomain routes to the same backend, which extracts the tenant from the Host header. Good: Intuitive, visible in the URL. Bad: Requires wildcard TLS certs, more complex DNS setup, awkward in development, doesn't work for mobile API clients the same way. 2. URL path-based ( /api/tenants/{tenantId}/... ) The tenant identifier is part of every route path. Good: RESTful, self-documenting. Bad: Bloats all route definitions, requires every endpoint to include the tenant segment, makes API versioning messier. 3. Header-based ( x-tenant-id: <id> ) A custom header carries the tenant context. Routes stay clean. The tenant scope is resolved in middleware before the handler runs. Good: Routes stay simple, middleware handles scoping uniformly, works well with JWT auth, easy to test. Bad: Less visible (the tenant isn't in the URL), requires clients to always include the header. We use the header approach. The Implementation The API accepts two forms of auth: A JWT token in the Authorization header — identifies who is making the request A tenant ID in the x-tenant-id header — identifies on behalf of which tenant POST /api/v1/members Authorization: Bearer eyJhbGciOiJIUzI1NiIs... x-tenant-id: ten

I build products solo. Every single one of them sits on top of somebody else's API — Stripe for payments, OpenAI and Anthropic for AI features, Meta for ads, print-on-demand APIs, map APIs. My code is maybe half of what actually runs in production. The other half belongs to vendors, and it changes whenever they decide it changes. Twice this year the first notice I got about a breaking change was a production error. Not an email, not a warning. An error, and then me digging through the vendor's changelog trying to figure out what they changed and when. The information was public the whole time. It was sitting in a changelog page I never visit, because nobody visits changelog pages until something is on fire. So I'm building the thing I wanted to exist BreakWatch is simple: you tell it which APIs your product depends on, and it reads their public changelogs for you. It fetches each changelog page once a day Diffs it against yesterday's snapshot Classifies the real changes: breaking (endpoint removed, field deprecated, "migrate by September") vs. informational (new feature, docs clarification — stuff you can ignore) Alerts you only when something looks like it will break an existing integration Keeps everything in a searchable timeline, so six months later "what changed on their side right before this broke" takes ten seconds instead of an afternoon No SDK, no credentials, nothing installed in your codebase. It only reads public pages. What I tested this week I ran it against the real changelogs of the ten APIs I'm watching first: Stripe, Twilio, OpenAI, Anthropic, Shopify, GitHub, Slack, Cloudflare, Google Maps and Plaid. Some honest findings: 10/10 scrape cleanly now, but it took fixes. Stripe's changelog page alone is 3.3 MB. SendGrid's standalone changelog doesn't exist anymore (it merged into Twilio's). PayPal's developer site serves a JavaScript shell with an HTTP 404 to anything that isn't a full browser, so it's out until I add rendering. The thing I was most a

A headless content API has two kinds of callers, and it's tempting to secure them the same way. That's the mistake. There's a human logging into an admin UI to edit content, and there's a machine — a website, a build step — pulling published content through a delivery endpoint. They authenticate with different credentials, and those credentials have opposite properties. Treat them identically and you either make the machine path painfully slow or the human path dangerously weak. I built a small headless content API ( Depot ) partly to get this boundary right. Here's the reasoning. The two credentials A session proves "this human is logged in." Short-lived, rides in an httpOnly cookie, checked on management routes. A delivery token proves "this machine may read this account's published content." Long-lived, sent as a Bearer header, checked on every public read. Two auth surfaces, kept explicit: /** * - requireUser() — admin session (httpOnly JWT cookie) for the management API. * - requireToken() — a `depot_…` bearer token for the public delivery API. */ Why they get different hashing Here's the part people get wrong. Both credentials get stored as hashes — never plaintext — but not the same kind of hash , and the reason is entropy. Passwords are low-entropy. Humans pick summer2024 . An attacker who steals your DB will brute-force guesses against the stored hashes, so you want hashing to be deliberately slow — that's exactly what bcrypt's cost factor buys you: import bcrypt from " bcryptjs " ; const ROUNDS = 10 ; // deliberately slow — the point is to resist brute force export function hashPassword ( plain : string ): Promise < string > { return bcrypt . hash ( plain , ROUNDS ); } export function verifyPassword ( plain : string , hash : string ): Promise < boolean > { return bcrypt . compare ( plain , hash ); } Tokens are high-entropy. I generate them — 32 random bytes — so there's nothing to guess. A stolen hash can't be reversed by brute force because the keyspace i

Google continues to report big quarterly revenue, but its AI spending has skyrocketed.

As a backend developer, I have build hundreds of endpoints, so the typical endpoint flow is deeply ingrained in how I think about web applications. But when I started building AI-powered endpoints, I noticed an interesting shift. At first, AI endpoints looked like simple proxy endpoints with some configuration for connecting to a model: API receives request ↓ send prompt to model ↓ receive response ↓ return it to the client And it worked well until I found out that passing a prompt directly from the client was not a good idea. The endpoint could be misused for a completely different purpose, allowing someone else to consume my AI usage credits. Then I realized that the input also needed limits. Sending a large context for a specific task costs more and may produce unexpected results. So when I started looking closer, especially when I needed reliable structured output and predictable application behavior, I quickly realized that it was not that simple. Validation was no longer only guarding execution, it had also become a post-processing step. AI models are probabilistic. Even with the same input, they may return different outputs, omit required information, misunderstand instructions or return something that is technically valid but logically wrong. And because every token has a price, I cannot simply retry the request and hope for a better result. That was when I started questioning whether AI endpoints should be designed in the same way as conventional Web API endpoints. Table of Contents Conventional Web API Endpoint Flow AI-powered Web API Endpoint Flow What This Difference Changes Unpredictable Latency Retry Logic Idempotency and Side Effects Testing AI Endpoints The Output Contract Observability and Cost Summary Conventional Web API Endpoint Flow A conventional Web API endpoint usually follows a similar flow: validate request ↓ execute business logic ↓ return representation The first phase is request validation. We validate the incoming data against property

Seu agente escreveu o teste. O Cursor sugeriu três casos extremos que você não havia pensado. O Copilot preencheu o corpo da requisição, e o Claude executou tudo uma vez e reportou “verde”. A pergunta é justa: se o agente faz tudo isso, a IA pode substituir completamente o teste de API? Experimente o Apidog hoje Não. A IA não substitui o teste de API, mas já substitui boa parte da autoria dos testes. Agentes elaboram casos, sugerem cenários extremos e geram payloads com eficiência. Porém, eles não garantem execução idêntica em cada commit, não bloqueiam merges com um resultado confiável e não decidem se um contrato está correto. Para isso, você precisa de uma ferramenta determinística e de revisão humana. Essa separação responde a uma dúvida maior: você ainda precisa de uma ferramenta de API na era dos agentes de IA ? Sim — mas o papel da ferramenta mudou. Use agentes para acelerar a autoria e ferramentas determinísticas para validar, executar e bloquear regressões. Onde este artigo difere do guia prático Se você procura instruções para gerar testes com agentes, consulte o guia sobre como usar agentes de IA para teste de API . Este artigo trata de outra pergunta: quais partes do fluxo você pode delegar a um agente e quais precisam continuar em uma suíte determinística? Uma implementação prática separa o trabalho assim: O agente lê a especificação e cria um rascunho de testes. Um desenvolvedor revisa cenários, asserções e regras de negócio. Um runner headless executa a suíte no CI. O pipeline bloqueia o merge usando o código de saída do runner. Quando algo falha, você inspeciona a requisição e a resposta reais. O que a IA faz bem em testes de API hoje Agentes removem trabalho repetitivo de autoria. Use-os principalmente para criar e expandir artefatos de teste. Elaborar uma primeira suíte a partir de uma especificação Entregue ao agente um endpoint, uma definição OpenAPI ou uma resposta de exemplo. Ele pode gerar rapidamente: verificações de status HTTP; asserções de

Most developers think about crypto payments as a checkout problem. Generate an invoice. Show a payment page. Wait for a webhook. Mark the order as paid. That is the clean version. Real merchants do not live in the clean version. They live in support tickets. A customer says they paid, but the order is still pending. A payment arrives after the invoice expires. Someone sends the right amount on the wrong network. A webhook fails. A customer underpays. A support agent cannot tell whether the issue is customer error, blockchain delay, invoice expiry, fulfillment failure, or an internal system bug. This is where developers can build a real product. A Crypto Payment Support Desk is a support and operations layer for merchants that accept crypto payments. It helps support teams search payments, inspect payment timelines, classify issues, explain statuses to customers, escalate real problems, and reduce the amount of manual investigation required for every crypto payment ticket. In this article, I will use OxaPay as the example payment infrastructure because its documentation exposes the primitives needed to build this kind of product: invoice generation, payment status callbacks, HMAC-signed webhooks, payment information lookup, payment history, static addresses, SDKs, plugins, and automation integrations. This is not a generic “add crypto payments to your app” article. It is a blueprint for developers who want to build a support-facing product that merchants may actually pay for. The business idea The idea is simple: Build a support desk that sits between a merchant's payment system, order system, and support team. The merchant already accepts crypto payments. The problem is that their support team cannot quickly answer payment-related questions. Your product gives them one place to investigate cases like: “The customer says they paid, but the order is unpaid.” “The invoice expired, but a transaction later appeared.” “The payment is underpaid.” “The webhook was received,

I love InertiaJS to the point where it's becoming a personality trait I tend to want to use it for everything, but adding Inertia to an existing Laravel API gets awkward fast. Same thing happens in the other direction: you start with a full Inertia frontend and then realize you want to expose some of that data as a public API too. The naive solutions are: Sprinkle if ($request->wantsJson()) into your controllers Maintain two separate routes that return the exact same data Neither feels right. So I made inertia-split Starting fresh with Inertia: serve both from the same controller class ProjectController extends Controller { use HasHybridResponses ; public function index () { return $this -> respond () -> component ( 'Projects/Index' , [ 'projects' => Project :: all (), ]); // Inertia request → renders the Svelte/Vue/React component // API request → returns JSON } } The controller doesn't check anything. Inertia requests get an Inertia response, API clients get JSON. Existing API? Don't touch it If you just want to make an existing API method Inertia-aware, one annotation is enough: #[InertiaComponent('Users/Show')] public function show ( User $user ): array { return [ 'user' => $user ]; } The method body stays exactly as it was. Inertia requests get the component rendered with your data as props. Everything else gets the same JSON as before. Methods without the annotation are completely unaffected. Wait, how does this even work? The package can out Inertia's ResponseFactory for its own in the service provider (opt-in): $this -> app -> singleton ( ResponseFactory :: class , HybridResponseFactory :: class ); // checks if it's an Inertia request and returns appropriate response Good old OOP. Thank you polymorphism. Wrap-up Whatever the direction of your problem, making Inertia and API endpoints use the same controller is a big win. You're still responsible for writing routes and wiring middlewares, but this should save a lot of time and effort. Still in beta, use accor

Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it. The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog .

most people know Mistral for its chat models. the part i find more interesting for enterprise work is the Agents API : persistent agents with instructions and tools, stateful conversations you can resume, built-in connectors (web search, code interpreter, document library), and handoffs so one agent can delegate to another. the .net story stops short of this. the community sdks (tghamm's is genuinely good) cover chat completions, embeddings and function calling. they don't cover the agentic layer. so if you're a .net shop that wants to build a multi-agent workflow on mistral, you're writing raw http. i didn't want to, so i built Mistral.Agents.Net . here's the design and the one wire-format detail that cost me a debugging session. agents, not just completions a chat completion is stateless: you send messages, you get a reply, you manage all the history yourself. an agent is a stored object with instructions and tools, and a conversation is a stateful thread you can continue by id. that difference matters for enterprise workflows, where a "session" spans many turns and you want the platform to hold the state. var agent = await client . CreateAgentAsync ( new CreateAgentRequest { Model = "mistral-medium-latest" , Name = "Financial Analyst" , Instructions = "Use the code interpreter for math and web search for current facts." , Tools = { AgentTool . CodeInterpreter (), AgentTool . WebSearch () }, }); using var turn = await client . StartConversationAsync ( new StartConversationRequest { AgentId = agent . Id , Inputs = "what was 15% of last quarter's revenue if it was 12.4M?" , }); Console . WriteLine ( turn . OutputText ); the response isn't a single message. it's a list of outputs: tool executions, message chunks, function calls, handoffs. the library gives you OutputText for the common case and Outputs for the raw stream, plus a Root JsonElement escape hatch for anything the typed model doesn't cover yet. same philosophy i used for the serpapi and elevenlabs clients:

A customer clicks the Pay button, the server sends the request to a payment provider, and the charge succeeds. The trouble begins when the response never reaches the browser because the connection drops. The frontend sees a timeout and retries the same request, while the backend treats it as a brand-new payment. One customer action has now created two valid charges. This kind of failure is easy to miss because every part of the system appears to behave correctly on its own. The browser retries because it never received a response, the API processes a valid POST request, and the payment provider accepts the instruction it was given. The defect sits between those systems, where no component has enough context to know that the second request is a repeat. The same pattern can create duplicate orders, emails, subscriptions, shipments, support tickets, or background jobs. The common advice is to retry failed requests, but that advice is incomplete. A retry is safe only when the server can distinguish a repeated business operation from a new one. For payment APIs, that usually means introducing an idempotency key, storing the original result, and protecting the write path against race conditions. The rest of this article walks through that flow using Node.js, Express, and PostgreSQL. The bug starts with a normal-looking endpoint Consider a small Express endpoint that creates a payment by calling an external provider. The code receives the request body, sends the amount and customer data to the provider, and returns the resulting payment object. Nothing about this route looks obviously unsafe during a basic code review, and the happy-path test is likely to pass without trouble. The risk appears only when the request succeeds remotely but the response is lost before the client receives it. `app.post("/payments", async (req, res, next) => { try { const payment = await paymentProvider.charge({ customerId: req.body.customerId, amount: req.body.amount, currency: req.body.currenc

Most SaaS products do not need a “crypto payment button.” They need a payment module. That distinction matters. A button can redirect a customer to a payment page. A module has to know which user is paying, which workspace should be upgraded, which plan should become active, when access should expire, how failed or expired payments should be handled, how support can inspect payment status, and how finance can export records later. That is where developers can build a serious product. A Crypto Payment Module for SaaS Apps is a reusable layer that lets SaaS builders add crypto payments without building the whole payment lifecycle from scratch. In this article, I will use OxaPay as the example crypto payment infrastructure because its documentation exposes the primitives needed for this kind of module: invoice generation, white-label payments, static addresses, webhooks, payment information, payment history, SDKs for PHP, Python and Laravel, and automation integrations. This is not a “get rich with crypto APIs” article. It is a practical blueprint for developers who want to build something SaaS founders, indie hackers, agencies, and product teams may actually pay for. The core idea A Crypto Payment Module gives SaaS apps a production-ready way to accept crypto payments and translate payment events into SaaS account states. Instead of selling this: I can integrate crypto payments into your app. You sell this: I can give your SaaS a reusable crypto billing module with invoices, payment status tracking, webhook verification, plan activation, grace periods, admin tools, and payment history sync. That is a much stronger offer. A SaaS founder does not only care that a payment happened. They care that the right account is upgraded, the right plan is applied, the right billing period is extended, the right user sees the right status, and the support team can understand what happened when something goes wrong. That is what your module should solve. Why this is a real developer

Validate what comes in, shape what goes out, and give every outcome its proper status code. So Phase 1 gave my app a memory — a real database that remembers users and expenses even after a restart. Small problem: the only way to actually talk to it was a Python script I ran by hand. The app could remember things, but it was mute. Nobody on the internet could add an expense, list their spending, or delete a typo. Phase 2 fixes that. This is where the app grows a mouth — real HTTP endpoints you hit through the browser. The buzzword is CRUD : Create, Read, Update, Delete. The four things basically every app does to data. I went in thinking "it's just four functions, how hard can it be" and came out having learned about request/response contracts, dependency injection, and roughly six different HTTP status codes — mostly by triggering them wrong first. Let me dump what I learned [and the parts that tripped me up, because there were, uh, several]. The Structure is as follows. Lets call it PHASE 2 — The Endpoints: Set up the request/response contracts (two Pydantic schemas: one for input, one for output) Build a session dependency so every request gets a safe, auto-closing DB connection POST — create an expense GET — list them all + fetch one [with a proper 404] PATCH — update just the fields that changed DELETE — remove one cleanly First, the two new ideas [and no, nothing to install this time] Phase 1 had two new libraries. Phase 2 has two new ideas — and the nice part is there's nothing to pip install , because Pydantic already ships inside FastAPI. [Which means requirements.txt didn't change this phase. Still worth knowing the freeze habit is only for phases where you actually install something.] Pydantic — the bouncer at the door. Your SQLAlchemy models describe how data is stored ; Pydantic describes the shape data must have to cross the border of your API . It checks types, rejects garbage, and turns raw JSON into a clean Python object before it gets anywhere near

I honestly thought learning REST APIs would be easy. At first, creating a simple GET or POST endpoint feels straightforward and you start thinking, "I've got this." Then reality hits. Every API needs middleware, validation, error handling, controllers, database integration, authentication, authorization, testing, pagination, CORS, environment variables, deployment and a dozen other things. Somewhere along the way, you realize you didn't just sign up to build an API—you signed up to build an entire backend ecosystem. 😂💻

If your Clio integration started returning 401 and you are trying to work out why, the first question is not about your code. It is which of Clio's two OAuth systems you are on, because they have different rules and most advice on the internet does not say which one it is describing. There are two, and they are not interchangeable Clio Manage is the older one. OAuth at app.clio.com/oauth , API at app.clio.com/api/v4 . Clio Platform is the newer one, covering Grow and the lead inbox among others. OAuth at auth.api.clio.com/oauth , API at api.clio.com . They differ on essentially every point that matters when a token dies. Manage Platform Access token lifetime 2,592,000s, 30 days 86,400s, 24 hours Refresh token expiry Documented as none No time expiry, but rotates Refresh token rotation Not documented, and the refresh sample returns no new refresh token Documented: rotates on every use, previous one revoked Revocation endpoint POST app.clio.com/oauth/deauthorize , Bearer auth POST auth.api.clio.com/oauth/revoke , Basic auth Treat the lifetime row as the documented default rather than a constant. Honour the expires_in you get back on each response instead of hardcoding 30 days, because there are field reports of accounts issuing much shorter access tokens, and a hardcoded assumption fails in a way that looks exactly like revocation. That rotation row is the one that decides your debugging. On Platform , every refresh gives you a new refresh token and kills the old one, so failing to persist the new value out of each response leaves you holding a dead token the next time you try. Clio's docs say it directly: store the new refresh token returned in each response. On Manage , the documented behaviour is a long-lived refresh token that does not expire and is not replaced. Their refresh response sample does not even include a refresh_token field. So on Manage, a token that suddenly stops working usually points somewhere else: revocation, or the wrong region. The region trap

There are two versions of this job and they have different answers. Most of the confusion, including ours, comes from assuming they are the same thing. Applying a whole template list to a matter Clio's interface has a button for this, and the natural assumption is that there is a matching endpoint on the task template resource. There is not. Nothing under /task_template_lists will assign anything to a matter, and no path in Clio's spec contains "apply". It is done from the matter instead. Both POST /matters.json and PATCH /matters/{id}.json accept a nested array: task_template_list_instances[] : task_template_list : { id } required on POST assignee_id : the user the list is assigned to notify_assignees : whether assignees get notified due_at : ISO-8601 date (format : date, not date-time) Those are the only two operations in the API that accept it. Note the asymmetry: on POST /matters.json the task_template_list object is required, and on PATCH /matters/{id}.json the item schema marks nothing as required at all. POST /task_template_lists/{id}/copy.json exists and sounds like the thing you want. It is not. It duplicates a list into another list , takes name , description and practice_area (all optional), and has no matter parameter. The two problems that will actually cost you time Instances are write-only. task_template_list_instances appears in those two request bodies and nowhere in the matter response schema. So there is no documented way to ask "does this matter already have the list on it?" You verify by fetching /tasks.json filtered to the matter and matching on names, which is uglier than it sounds and is most of the reconciliation work. Which makes idempotency your problem. If your automation fires the PATCH twice, nothing in the API stops you assigning the checklist twice. For anything triggered off matter creation or a stage change, decide up front how you detect an already-applied list, because the readback above is the only tool you have. Between them, th