Working With Data and APIs

Every non-trivial application needs to remember things between sessions and talk to the outside world. A flashcard app remembers your cards and your progress. A weather app talks to a weather service. A social platform stores posts and retrieves them in personalized order. Understanding how data storage and external communication work — even at a conceptual level — lets you design applications that are correct, robust, and maintainable, and lets you prompt AI with the precision these designs require.

Persistence: Making Data Outlast a Session

When a program runs, its variables live in memory — they exist only while the program is executing. When the program stops, that memory is cleared. Persistence is the property of data that survives the end of a program's execution: it is written to a durable medium (a file, a database) and can be read back on the next run. The most common persistence mechanism in web applications is a relational database. A relational database organizes data into tables — each table a set of rows with a fixed set of typed columns. Relationships between tables are expressed using foreign keys: a column in one table that stores the identifier of a row in another table. Example: an expense tracker has one table, expenses, with columns id, amount, category, date, note. If you later add user accounts, you add a users table and a user_id column to expenses — each expense row references the user it belongs to via that foreign key. Four fundamental operations on any database are Create (insert a new record), Read (retrieve records matching some condition), Update (modify an existing record), and Delete (remove a record). These are collectively called CRUD, and almost every feature in a data-driven application reduces to one or more of these operations. When using AI to generate database interactions, always specify: - The exact table name and column names - The operation (CRUD) - The filter condition for Read, Update, or Delete (which rows to affect) - Any sorting or limiting required (return the ten most recent expenses, for example)

A second persistence concern is data validation: ensuring that only correct data is written to the database. Validation happens in two places: Client-side validation (in the browser or app): fast feedback to the user before data is even sent to the server. A form that requires a positive number for the amount field gives an error immediately if the user types letters. Server-side validation (in the back-end): authoritative, cannot be bypassed. Even if a malicious user bypasses client-side validation and sends bad data directly to the server, server-side validation catches it before it reaches the database. Both are necessary. Client-side validation improves user experience. Server-side validation ensures data integrity. When prompting AI to generate validation code, specify both what is required and what the error response should look like when validation fails.

APIs: Talking to the Outside World

An API (Application Programming Interface) is a defined interface through which one software system requests services or data from another. When your application needs weather data, payment processing, email delivery, or mapping functionality, it does not build those capabilities from scratch — it calls an external API that provides them. The most common style of web API is REST (Representational State Transfer). In a REST API: - Resources (pieces of data) are identified by URLs. /expenses identifies the collection of expenses; /expenses/42 identifies the expense with id 42. - Operations on resources are expressed using HTTP methods: GET to read, POST to create, PUT or PATCH to update, DELETE to remove. - Responses are typically JSON — a text format that represents structured data as key-value pairs and arrays. To call an external API, your back-end sends an HTTP request (usually including an API key for authentication) and processes the JSON response. The API key is a credential — a secret string that identifies your application to the external service and controls billing and access. API keys must never be embedded in front-end code (where any user can read them) and must never be committed to a public code repository. When prompting AI to write API integration code, specify: - The name of the external API and the specific endpoint you are calling - The authentication method (API key in a header, for example) - The request format (method, URL, any required fields) - The response format and which fields you need - How to handle errors (the external API may be unavailable or may return an error status code)