Modern API Styles (Course #api-styles)
For developers, architects.
By the end, you can
By the end of this course, you will be able to match each use case to REST, GraphQL, gRPC, WebSocket/SSE or AMQP and implement the real-time paths on Anypoint so that protocol choices become documented decisions.
Running case study
Aurora Mobility runs its fleet platform on 120 REST APIs; partners demand gRPC for telematics, the mobile team suffers over-fetching, and the ops wallboard needs sub-second updates. Architecture must pick protocols per use case under NFRs: p95 under 150 ms for reads, fan-out to 50k concurrent WebSocket clients, and zero breaking changes to existing REST contracts.
Programme every line is something you do
5 modules · 13 topics · in course-flow order
-
Module 1
Match protocol to use case
Objective. Compare five API styles on latency, coupling and tooling and emit a decision matrix for your estate.
- Score REST/JSON, GraphQL, gRPC/Protobuf, WebSocket/SSE and AMQP 1.0 on latency, payload size and coupling
- Run the decision framework on 3 live use cases, documenting trade-offs (streaming vs polling, typing vs flexibility)
-
Module 2
GraphQL without the traps
Objective. Expose schema-driven resolvers on Anypoint and quantify payload savings against fixed REST projections.
- Model a schema and wire resolvers with the GraphQL connector, composing system APIs behind one endpoint
- Shrink mobile payloads with client-defined queries (target: −40% transferred bytes vs REST)
- Cap query depth and complexity to block N+1 storms and abusive introspection
-
Module 3
Real-time that scales
Objective. Operate a pub/sub WebSocket backbone sized for tens of thousands of concurrent clients.
- Implement pub/sub with the WebSocket connector: handshake, heartbeats, reconnect with backoff + jitter
- Spread sessions across CloudHub/RTF workers (target: 50k concurrent sockets per cluster)
- Downgrade to SSE when one-way streams suffice, comparing delivery guarantees per channel
- Receive webhooks defensibly: verify HMAC signatures, answer fast with 202 Accepted, process asynchronously off-queue
- Deduplicate callback receivers on event-id via Object Store so provider retries never double-fire a ride update
-
Module 4
Govern non-REST traffic
Objective. Extend API Manager policy enforcement to GraphQL and WebSocket endpoints with verified results.
- Apply OAuth 2.0 and rate-limiting policies to GraphQL and WebSocket endpoints via API Manager/Flex Gateway
- Throttle subscription floods with token-bucket limits (e.g. 10 msg/s per client) and watch policy hit rates
-
Module 5
Lab: live ops wallboard
Objective. Ship the lab deliverable: a traced chain from REST system API to a WebSocket-broadcast dashboard.
- Build the live dashboard chain — REST system API → process API → WebSocket experience API — with end-to-end tracing
References & Official Documentation every claim above has a source
Module 1
- APIkit OverviewMuleSoft Docs
Module 2
- APIkit for GraphQLMuleSoft Docs
- GraphQL Operation Limits PolicyMuleSoft Docs
Module 3
- RFC 6455 — The WebSocket ProtocolSpecification
- WebSockets ConnectorMuleSoft Docs
- WebSockets ReconnectionMuleSoft Docs
Module 4
- GraphQL Static Query Complexity PolicyMuleSoft Docs
- Rate Limiting PolicyMuleSoft Docs