02 - API Layer and Request Handling
This track picks up exactly where track 01 left off. In
01-request-response-fundamentals you learned how a request travels from a
client to a server and back — HTTP methods, headers, status codes, routing,
and serialization. This track moves up the stack to what happens inside the
server once that request arrives: how you validate it, wrap it in middleware,
give it request-scoped context, route it through clean layers of business
logic, turn it into correct CRUD, and design the whole thing as a coherent,
documented, RESTful API.
Everything is built in Python with FastAPI + Pydantic, and every module adds to one project you grow from an empty folder — by the capstone you'll have a complete, validated, middleware-chained, RESTful API with an auto-generated OpenAPI spec.
How this track works
- It assumes you finished track 01 — you're comfortable with HTTP methods, status codes, headers, routing, and JSON serialization. This track does not re-teach those; it builds on them.
- It assumes basic Python and basic FastAPI familiarity (you've stood up a
FastAPI app before). You'll want
pip install "fastapi[standard]" "pydantic[email]"to follow along. - Every module builds only on concepts from earlier modules in this track (plus track 01) — no forward references. Go in order; the object model is layered (validation feeds middleware feeds context feeds layering feeds CRUD feeds REST feeds OpenAPI).
- Each standard module has the same shape: why it matters, concepts (with concrete analogies), a code-pattern reference table, hands-on exercises (do them — including a diagnose-and-fix each), an independent challenge with no code given, common mistakes, and a checkpoint quiz. Two cumulative reviews (in modules 02 and 07) mix questions from everything so far, closed-book.
- The last module is an open-ended capstone with no solution given — it's the integration test for the whole track.
Modules
| # | Module | What you'll be able to do | Time |
|---|---|---|---|
| 00 | Validation fundamentals | Enforce type, syntactic, and semantic validation with Pydantic, and know why the server is the real security boundary | 45-60 min |
| 01 | Transformation and normalization | Cast, normalize, and sanitize input into canonical form — and know what actually stops injection | 45-60 min |
| 02 | Complex validation logic | Validate across fields, handle conditional rules, aggregate errors, and obscure sensitive ones | 60-90 min |
| 03 | Middleware fundamentals | Explain the request pipeline, write middleware, and short-circuit it correctly | 45-60 min |
| 04 | Common middleware patterns | Assemble the production middleware stack (security, CORS, rate limiting, auth, logging, errors) in the correct order | 60-90 min |
| 05 | Request context | Carry request-scoped state cleanly with dependency injection, and handle timeouts/cancellation | 60-90 min |
| 06 | Handlers, controllers, and services | Layer an API into thin handlers, HTTP-agnostic services, and repositories with centralized errors | 60-90 min |
| 07 | CRUD deep dive | Implement correct CRUD with pagination, search, sort, filter, and production safeguards | 75-100 min |
| 08 | RESTful architecture and best practices | Design around resources and HTTP semantics: versioning, content negotiation, ETag caching | 60-90 min |
| 09 | OpenAPI standards | Understand and produce an accurate OpenAPI contract, and reason about spec-first development | 45-60 min |
| 10 | Capstone project | Build a complete validated, middleware-chained, RESTful API with an auto-generated OpenAPI spec | 4-6 hrs |
Start here → 00-validation-fundamentals/README.md
Back to the master index: ../README.md
Once you've completed this track, the next one is 03-authentication-and-authorization — every endpoint you learned to build here gets a real identity and permission model behind it: sessions, JWTs, OAuth2/OIDC, API keys, MFA, and RBAC, plus the common auth security holes to avoid.