Python RESTful API 设计核心原则与实战

这种演进背后的技术驱动因素包括前端复杂性增加、微服务架构普及、移动端爆发以及对开发效率的高要求。

RESTful API 设计核心技术原理

资源设计哲学与实践

资源是 RESTful API 设计的核心，正确的资源建模是 API 成功的基础。

资源识别与建模

# resource_design.py
from typing import List, Dict, Any
from dataclasses import dataclass
from enum import Enum

class ResourceType(Enum):
    DOCUMENT = "document"
    COLLECTION = "collection"
    STORE = "store"
    CONTROLLER = "controller"

@dataclass
class APIResource:
    name: str
    type: ResourceType
    identifier: str
    attributes: List[str]
    relationships: Dict[str, str]

    def get_standard_endpoints(self) -> List[str]:
        base_path = f"/{self.name.lower()}s"
        endpoints = {
            ResourceType.COLLECTION: [
                f"GET {base_path}",
                f"POST {base_path}",
                f"GET {base_path}/{{id}}",
                f"PUT {base_path}/{{id}}",
                f"PATCH {base_path}/{{id}}",
                f"DELETE {base_path}/{{id}}"
            ],
            ResourceType.DOCUMENT: [
                f"GET {base_path}/{{id}}",
                f"PUT {base_path}/{{id}}",
                f"DELETE {base_path}/{{id}}"
            ]
        }
        return endpoints.get(self.type, [])

class ResourceDesigner:
    def __init__(self):
        self.resource_patterns = {}

    def analyze_domain_entities(self, business_domain: str) -> List[APIResource]:
        domain_patterns = {
            'ecommerce': [
                APIResource("product", ResourceType.COLLECTION, "sku", ["name", "price", "description"], {"category": "category", "reviews": "review"}),
                APIResource("order", ResourceType.COLLECTION, "order_id", ["total", "status", "created_at"], {"user": "user", "items": "order_item"})
            ],
            'social_media': [
                APIResource("post", ResourceType.COLLECTION, "post_id", ["content", "likes", "shares"], {"author": "user", "comments": "comment"})
            ]
        }
        return domain_patterns.get(business_domain, [])

    def validate_resource_design(self, resource: APIResource) -> Dict[str, Any]:
        issues = []
        if not resource.name.islower():
            issues.append("资源名称应该使用小写")
        if ' ' in resource.name:
            issues.append("资源名称不应包含空格")
        if len(resource.attributes) == 0:
            issues.append("资源应该包含至少一个属性")
        return {'resource': resource.name, 'valid': len(issues) == 0, 'issues': issues}

资源关系建模

资源关系设计的关键原则包括层级关系明确、避免过度嵌套、保持关系一致性以及考虑查询效率。

统一接口原则深度解析

统一接口是 RESTful API 的核心特征，确保系统各部分的通信一致性。

HTTP 方法语义化使用

# http_methods_design.py
from enum import Enum
from typing import Dict, Any

class HTTPMethod(Enum):
    GET = "GET"
    POST = "POST"
    PUT = "PUT"
    PATCH = "PATCH"
    DELETE = "DELETE"

class HTTPMethodDesign:
    def __init__(self):
        self.method_semantics = {
            HTTPMethod.GET: {'semantic': '检索资源', 'idempotent': True, 'safe': True},
            HTTPMethod.POST: {'semantic': '创建资源或执行操作', 'idempotent': False, 'safe': False},
            HTTPMethod.PUT: {'semantic': '创建或替换资源', 'idempotent': True, 'safe': False},
            HTTPMethod.PATCH: {'semantic': '部分更新资源', 'idempotent': False, 'safe': False},
            HTTPMethod.DELETE: {'semantic': '删除资源', 'idempotent': True, 'safe': False}
        }

    def validate_method_usage(self, method: HTTPMethod, context: Dict[str, Any]) -> Dict[str, Any]:
        semantic = self.method_semantics[method]
        issues = []
        if context.get('requires_safety') and not semantic['safe']:
            issues.append(f"{method.value} 方法不是安全的")
        if context.get('requires_idempotent') and not semantic['idempotent']:
            issues.append(f"{method.value} 方法不是幂等的")
        return {'method': method.value, 'appropriate': len(issues) == 0, 'issues': issues}

状态码语义化设计

HTTP 状态码是 API 通信的重要组成部分，正确的状态码使用可以提高 API 的可理解性。

# status_code_design.py
from typing import Dict, List

class StatusCodeDesign:
    def __init__(self):
        self.common_status_codes = {
            200: {'text': 'OK', 'usage': '标准成功响应'},
            201: {'text': 'Created', 'usage': '资源创建成功'},
            204: {'text': 'No Content', 'usage': '成功处理，但无内容返回'},
            400: {'text': 'Bad Request', 'usage': '请求格式错误'},
            401: {'text': 'Unauthorized', 'usage': '需要认证'},
            403: {'text': 'Forbidden', 'usage': '权限不足'},
            404: {'text': 'Not Found', 'usage': '资源不存在'},
            429: {'text': 'Too Many Requests', 'usage': '请求频率超限'}
        }

    def get_appropriate_status_code(self, scenario: str, details: Dict[str, Any]) -> int:
        scenario_mapping = {
            'success_retrieve': 200, 'success_create': 201, 'success_delete': 204,
            'client_error_generic': 400, 'authentication_required': 401,
            'resource_not_found': 404, 'rate_limit_exceeded': 429
        }
        return scenario_mapping.get(scenario, 500)

    def create_error_response(self, status_code: int, error_details: Dict[str, Any]) -> Dict[str, Any]:
        status_info = self.common_status_codes.get(status_code, {'text': 'Unknown', 'usage': ''})
        return {
            'error': {
                'code': status_code,
                'message': status_info['text'],
                'details': error_details.get('details', '')
            }
        }

HATEOAS 超媒体驱动设计

HATEOAS 是 REST 成熟度模型的最高级别，通过超媒体驱动客户端状态转换。

HATEOAS 原理与实现

# hateoas_design.py
from typing import List, Dict, Any
from dataclasses import dataclass

@dataclass
class Link:
    rel: str
    href: str
    method: str = "GET"
    title: str = ""
    type: str = "application/json"

class HATEOASDesign:
    def __init__(self, base_url: str):
        self.base_url = base_url.rstrip('/')

    def create_resource_links(self, resource_type: str, resource_id: str, available_actions: List[str]) -> List[Link]:
        links = []
        links.append(Link(rel="self", href=f"{self.base_url}/{resource_type}/{resource_id}", method="GET"))
        action_mappings = {
            'update': Link("update", f"{self.base_url}/{resource_type}/{resource_id}", "PUT"),
            'delete': Link("delete", f"{self.base_url}/{resource_type}/{resource_id}", "DELETE")
        }
        for action in available_actions:
            if action in action_mappings:
                links.append(action_mappings[action])
        return links

    def enhance_response_with_links(self, response_data: Dict[str, Any], links: List[Link]) -> Dict[str, Any]:
        links_dict = {}
        for link in links:
            links_dict[link.rel] = {'href': link.href, 'method': link.method, 'title': link.title}
        response_data['_links'] = links_dict
        return response_data

HATEOAS 客户端工作流程

实战部分：Python RESTful API 完整实现

Flask RESTful API 完整实现

基于 Flask 框架实现一个完整的 RESTful API，包含所有最佳实践。

项目结构与配置

# project_structure.py
import os
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_jwt_extended import JWTManager
from flask_cors import CORS
from datetime import timedelta

class ProjectStructure:
    def create_project_layout(self, project_name: str):
        directories = [
            f"{project_name}/app", f"{project_name}/app/controllers",
            f"{project_name}/app/models", f"{project_name}/app/schemas",
            f"{project_name}/config"
        ]
        for directory in directories:
            os.makedirs(directory, exist_ok=True)

def _create_app_init():
    return '''from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_jwt_extended import JWTManager
from flask_cors import CORS
from config import Config

db = SQLAlchemy()
jwt = JWTManager()

def create_app(config_class=Config):
    app = Flask(__name__)
    app.config.from_object(config_class)
    db.init_app(app)
    jwt.init_app(app)
    CORS(app)
    from app.controllers.users import users_bp
    app.register_blueprint(users_bp, url_prefix='/api/v1/users')
    with app.app_context():
        db.create_all()
    return app'''

def _create_user_model():
    return '''from app import db
from datetime import datetime
import uuid

class User(db.Model):
    __tablename__ = 'users'
    id = db.Column(db.String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    password_hash = db.Column(db.String(128), nullable=False)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    is_active = db.Column(db.Boolean, default=True)

    def to_dict(self):
        return {'id': self.id, 'username': self.username, 'email': self.email, 'is_active': self.is_active}'''

def _create_users_controller():
    return '''from flask import Blueprint, request, jsonify
from app.models.user import User
from app import db
from app.schemas.user_schema import UserSchema

users_bp = Blueprint('users', __name__)
user_schema = UserSchema()

@users_bp.route('', methods=['GET'])
def get_users():
    page = request.args.get('page', 1, type=int)
    per_page = request.args.get('per_page', 10, type=int)
    users = User.query.paginate(page=page, per_page=per_page, error_out=False)
    return jsonify({'users': [user.to_dict() for user in users.items], 'pagination': {'page': page, 'per_page': per_page, 'total': users.total}})

@users_bp.route('/<user_id>', methods=['GET'])
def get_user(user_id):
    user = User.query.get_or_404(user_id)
    return jsonify(user.to_dict())

@users_bp.route('', methods=['POST'])
def create_user():
    data = request.get_json()
    errors = user_schema.validate(data)
    if errors:
        return jsonify({'errors': errors}), 400
    if User.query.filter_by(username=data['username']).first():
        return jsonify({'error': 'Username already exists'}), 409
    user = User(username=data['username'], email=data['email'], password_hash=data['password'])
    db.session.add(user)
    db.session.commit()
    return jsonify(user.to_dict()), 201

@users_bp.route('/<user_id>', methods=['PUT'])
def update_user(user_id):
    user = User.query.get_or_404(user_id)
    data = request.get_json()
    if 'username' in data:
        user.username = data['username']
    if 'email' in data:
        user.email = data['email']
    db.session.commit()
    return jsonify(user.to_dict())

@users_bp.route('/<user_id>', methods=['DELETE'])
def delete_user(user_id):
    user = User.query.get_or_404(user_id)
    db.session.delete(user)
    db.session.commit()
    return '', 204'''

def _create_user_schema():
    return '''from marshmallow import Schema, fields, validate

class UserSchema(Schema):
    id = fields.Str(dump_only=True)
    username = fields.Str(required=True, validate=validate.Length(min=3, max=80))
    email = fields.Email(required=True)
    password = fields.Str(required=True, load_only=True, validate=validate.Length(min=6))
    is_active = fields.Boolean(dump_only=True)'''

def _create_config_init():
    return '''import os
from datetime import timedelta

class Config:
    SECRET_KEY = os.environ.get('SECRET_KEY') or 'dev-secret-key'
    SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or 'sqlite:///app.db'
    SQLALCHEMY_TRACK_MODIFICATIONS = False
    JWT_SECRET_KEY = os.environ.get('JWT_SECRET_KEY') or 'jwt-secret-key'
    JWT_ACCESS_TOKEN_EXPIRES = timedelta(hours=1)

class DevelopmentConfig(Config):
    DEBUG = True

class ProductionConfig(Config):
    DEBUG = False

config = {'development': DevelopmentConfig, 'production': ProductionConfig, 'default': DevelopmentConfig}'''

def _create_run_script(project_name):
    return f'''from app import create_app
app = create_app()
if __name__ == '__main__':
    app.run(debug=True)'''

def _create_requirements():
    return '''Flask==2.3.3
Flask-RESTful==0.3.10
Flask-SQLAlchemy==3.0.5
Flask-JWT-Extended==4.5.3
Flask-CORS==4.0.0
marshmallow==3.20.1'''

API 版本控制实现

# api_versioning.py
from flask import Blueprint, request, jsonify
from functools import wraps

class APIVersioning:
    def __init__(self, app=None):
        self.app = app
        self.versions = {}
        if app:
            self.init_app(app)

    def init_app(self, app):
        self.app = app
        self._register_versioned_routes()

    def add_version(self, version: str, blueprint: Blueprint, prefix: str = None):
        self.versions[version] = {'blueprint': blueprint, 'prefix': prefix or f'/api/{version}'}

    def _register_versioned_routes(self):
        for version, config in self.versions.items():
            self.app.register_blueprint(config['blueprint'], url_prefix=config['prefix'])

    def versioned_route(self, versions: list):
        def decorator(f):
            @wraps(f)
            def decorated_function(*args, **kwargs):
                api_version = request.headers.get('API-Version', request.args.get('version', 'v1'))
                if api_version not in versions:
                    return jsonify({'error': f'Unsupported API version: {api_version}', 'supported_versions': versions}), 400
                request.api_version = api_version
                return f(*args, **kwargs)
            return decorated_function
        return decorator

def create_versioned_api():
    from flask import Flask
    app = Flask(__name__)
    versioning = APIVersioning(app)
    v1_bp = Blueprint('v1', __name__)
    @v1_bp.route('/users')
    @versioning.versioned_route(['v1'])
    def get_users_v1():
        return jsonify({'version': 'v1', 'users': [], 'pagination': {'page': 1, 'per_page': 10}})
    v2_bp = Blueprint('v2', __name__)
    @v2_bp.route('/users')
    @versioning.versioned_route(['v2'])
    def get_users_v2():
        return jsonify({'version': 'v2', 'users': [], 'pagination': {'page': 1, 'per_page': 20}, 'includes': ['profile']})
    versioning.add_version('v1', v1_bp)
    versioning.add_version('v2', v2_bp)
    return app

认证与授权安全实现

JWT 认证实现

# authentication.py
from flask import request, jsonify
from flask_jwt_extended import JWTManager, create_access_token, jwt_required, get_jwt_identity
from functools import wraps
import datetime

class AuthenticationSystem:
    def __init__(self, app):
        self.app = app
        self.jwt = JWTManager(app)
        self.setup_jwt_handlers()

    def setup_jwt_handlers(self):
        @self.jwt.expired_token_loader
        def expired_token_callback(jwt_header, jwt_payload):
            return jsonify({'error': 'token_expired', 'message': 'The token has expired'}), 401

        @self.jwt.invalid_token_loader
        def invalid_token_callback(error):
            return jsonify({'error': 'invalid_token', 'message': 'Signature verification failed'}), 401

    def authenticate_user(self, username: str, password: str):
        user = self._get_user_by_username(username)
        if user and self._verify_password(password, user.password_hash):
            return user
        return None

    def create_token(self, user_id: str, additional_claims: dict = None):
        claims = {'user_id': user_id, 'iss': 'api.example.com', 'aud': 'api.example.com'}
        if additional_claims:
            claims.update(additional_claims)
        access_token = create_access_token(identity=user_id, additional_claims=claims, expires_delta=datetime.timedelta(hours=1))
        return access_token

    def role_required(self, role: str):
        def decorator(f):
            @wraps(f)
            @jwt_required()
            def decorated_function(*args, **kwargs):
                current_user = get_jwt_identity()
                user_roles = self._get_user_roles(current_user)
                if role not in user_roles:
                    return jsonify({'error': 'insufficient_permissions', 'message': f'Role {role} required'}), 403
                return f(*args, **kwargs)
            return decorated_function
        return decorator

    def _get_user_by_username(self, username: str):
        users = {'admin': {'id': '1', 'username': 'admin', 'roles': ['admin']}, 'user': {'id': '2', 'username': 'user', 'roles': ['user']}}
        return users.get(username)

    def _verify_password(self, password: str, password_hash: str) -> bool:
        return password == 'password'

    def _get_user_roles(self, user_id: str):
        users = {'1': ['admin'], '2': ['user']}
        return users.get(user_id, [])

速率限制实现

# rate_limiting.py
from flask import request, jsonify
from functools import wraps
import time
from collections import defaultdict

class RateLimiter:
    def __init__(self, max_requests: int = 100, window: int = 3600):
        self.max_requests = max_requests
        self.window = window
        self.requests = defaultdict(list)

    def is_rate_limited(self, identifier: str) -> bool:
        now = time.time()
        self.requests[identifier] = [req_time for req_time in self.requests[identifier] if now - req_time < self.window]
        if len(self.requests[identifier]) >= self.max_requests:
            return True
        self.requests[identifier].append(now)
        return False

    def rate_limit_decorator(self, key_func=None):
        def decorator(f):
            @wraps(f)
            def decorated_function(*args, **kwargs):
                if key_func:
                    identifier = key_func()
                else:
                    identifier = request.remote_addr
                if self.is_rate_limited(identifier):
                    return jsonify({'error': 'rate_limit_exceeded', 'message': 'Too many requests'}), 429
                response = f(*args, **kwargs)
                return response
            return decorated_function
        return decorator

def create_rate_limited_endpoint():
    from flask import Flask
    app = Flask(__name__)
    limiter = RateLimiter(max_requests=10, window=60)

    @app.route('/api/sensitive-operation')
    @limiter.rate_limit_decorator()
    def sensitive_operation():
        return jsonify({'message': 'Sensitive operation completed'})
    return app

高级应用与企业级实战

企业级 API 网关设计

基于微服务架构的企业级 API 网关实现，包含路由、认证、限流等功能。

网关架构设计

# api_gateway.py
from flask import Flask, request, jsonify
import requests
from urllib.parse import urlparse

class APIGateway:
    def __init__(self):
        self.app = Flask(__name__)
        self.services = {
            'user-service': {'url': 'http://user-service:8000', 'routes': ['/users/*'], 'rate_limit': 1000},
            'product-service': {'url': 'http://product-service:8001', 'routes': ['/products/*'], 'rate_limit': 2000}
        }
        self.setup_routes()

    def setup_routes(self):
        @self.app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
        def gateway_proxy(path):
            target_service = self.find_target_service(path, request.method)
            if not target_service:
                return jsonify({'error': 'service_not_found'}), 404
            return self.forward_request(target_service, path)

    def find_target_service(self, path: str, method: str) -> dict:
        for service_name, service_config in self.services.items():
            for route_pattern in service_config['routes']:
                if route_pattern.endswith('*'):
                    if path.startswith(route_pattern[:-1]):
                        return {'name': service_name, 'url': service_config['url']}
        return None

    def forward_request(self, target_service: dict, path: str):
        target_url = f"{target_service['url']}/{path}"
        headers = {key: value for key, value in request.headers if key.lower() not in ['host', 'content-length']}
        try:
            response = requests.request(method=request.method, url=target_url, headers=headers, data=request.get_data(), params=request.args)
            gateway_response = jsonify(response.json())
            gateway_response.status_code = response.status_code
            return gateway_response
        except requests.exceptions.RequestException as e:
            return jsonify({'error': 'service_unavailable'}), 503

    def run_gateway():
        gateway = APIGateway()
        gateway.app.run(host='0.0.0.0', port=8080, debug=True)

性能监控与优化

性能监控系统

# performance_monitoring.py
import time
import statistics
from datetime import datetime
from functools import wraps
from typing import Dict, List

class PerformanceMonitor:
    def __init__(self):
        self.metrics = {'response_times': [], 'endpoint_performance': {}}

    def track_performance(self, endpoint: str):
        def decorator(f):
            @wraps(f)
            def decorated_function(*args, **kwargs):
                start_time = time.time()
                try:
                    result = f(*args, **kwargs)
                    response_time = time.time() - start_time
                    self.record_metrics(endpoint, response_time, True)
                    return result
                except Exception as e:
                    response_time = time.time() - start_time
                    self.record_metrics(endpoint, response_time, False)
                    raise e
            return decorated_function
        return decorator

    def record_metrics(self, endpoint: str, response_time: float, success: bool):
        timestamp = datetime.utcnow()
        self.metrics['response_times'].append({'endpoint': endpoint, 'response_time': response_time, 'timestamp': timestamp, 'success': success})
        if endpoint not in self.metrics['endpoint_performance']:
            self.metrics['endpoint_performance'][endpoint] = {'response_times': [], 'error_count': 0, 'request_count': 0}
        endpoint_metrics = self.metrics['endpoint_performance'][endpoint]
        endpoint_metrics['request_count'] += 1
        endpoint_metrics['response_times'].append(response_time)
        if not success:
            endpoint_metrics['error_count'] += 1

    def get_performance_report(self) -> Dict:
        recent_responses = self.metrics['response_times'][-100:]
        if recent_responses:
            response_times = [r['response_time'] for r in recent_responses]
            avg_response_time = statistics.mean(response_times)
            p95_response_time = sorted(response_times)[int(len(response_times) * 0.95)]
            error_count = sum(1 for r in recent_responses if not r['success'])
            error_rate = error_count / len(recent_responses)
        else:
            avg_response_time = p95_response_time = error_rate = 0
        return {
            'uptime_seconds': time.time(),
            'recent_performance': {'avg_response_time': avg_response_time, 'p95_response_time': p95_response_time, 'error_rate': error_rate},
            'health_status': 'healthy' if error_rate < 0.1 and avg_response_time < 5.0 else 'degraded'
        }

def create_monitored_endpoint():
    from flask import Flask, jsonify
    app = Flask(__name__)
    monitor = PerformanceMonitor()

    @app.route('/api/users')
    @monitor.track_performance('/api/users')
    def get_users():
        time.sleep(0.1)
        return jsonify({'users': []})

    @app.route('/api/performance')
    def performance_dashboard():
        report = monitor.get_performance_report()
        return jsonify(report)
    return app

故障排查与调试指南

常见问题诊断与解决

基于真实项目经验，总结 RESTful API 开发中的常见问题及解决方案。

API 故障排查清单

# troubleshooting.py
from typing import List, Dict, Any
import logging

class APITroubleshooter:
    def __init__(self):
        self.common_issues = {
            'authentication': {'symptoms': ['401 Unauthorized', '403 Forbidden'], 'causes': ['无效的 API 密钥', '过期的访问令牌'], 'solutions': ['验证 API 密钥', '刷新访问令牌']},
            'rate_limiting': {'symptoms': ['429 Too Many Requests'], 'causes': ['请求频率超限'], 'solutions': ['降低请求频率', '实现请求队列']},
            'validation_errors': {'symptoms': ['400 Bad Request', '422 Unprocessable Entity'], 'causes': ['请求体格式错误'], 'solutions': ['检查请求体格式', '验证所有必需字段']},
            'server_errors': {'symptoms': ['500 Internal Server Error'], 'causes': ['服务器内部错误'], 'solutions': ['检查服务器日志', '验证依赖服务状态']}
        }
        self.setup_logging()

    def setup_logging(self):
        logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
        self.logger = logging.getLogger(__name__)

    def diagnose_issue(self, error_response: Dict[str, Any]) -> List[str]:
        symptoms = self.identify_symptoms(error_response)
        possible_issues = []
        for issue_type, issue_info in self.common_issues.items():
            if any(symptom in symptoms for symptom in issue_info['symptoms']):
                possible_issues.append(issue_type)
        recommendations = []
        for issue_type in possible_issues:
            recommendations.extend(self.common_issues[issue_type]['solutions'])
        self.logger.info(f"诊断问题：症状={symptoms}, 建议={recommendations}")
        return recommendations

    def identify_symptoms(self, error_response: Dict[str, Any]) -> List[str]:
        symptoms = []
        status_code = error_response.get('status_code', 0)
        if status_code >= 400:
            symptoms.append(f"{status_code} {self.get_status_text(status_code)}")
        error_message = error_response.get('error', {}).get('message', '')
        if 'rate limit' in error_message.lower():
            symptoms.append('429 Too Many Requests')
        return symptoms

    def get_status_text(self, status_code: int) -> str:
        status_texts = {400: 'Bad Request', 401: 'Unauthorized', 403: 'Forbidden', 404: 'Not Found', 429: 'Too Many Requests', 500: 'Internal Server Error'}
        return status_texts.get(status_code, 'Unknown')

def demonstrate_troubleshooting():
    troubleshooter = APITroubleshooter()
    error_response = {'status_code': 429, 'error': {'code': 'rate_limit_exceeded', 'message': 'Rate limit exceeded'}}
    recommendations = troubleshooter.diagnose_issue(error_response)
    print("故障排查结果:")
    for i, recommendation in enumerate(recommendations, 1):
        print(f"{i}. {recommendation}")

参考资源

1. RESTful API Design Guide - RESTful API 设计权威参考
2. HTTP Status Codes RFC 7231 - HTTP 协议状态码标准
3. JSON API Specification - JSON API 设计标准
4. OpenAPI Specification - API 描述标准

优秀的 API 设计是一个持续改进的过程，需要结合具体业务场景不断优化。Happy coding!