#api-design

Anthropic's Messages API can now hold a conversation server-side until 5 minutes after the last request. What a thread stores, costs and where it is barred.

Eleven MCP server design mistakes drawn from the 2026-07-28 spec, its security best practices and Anthropic's tool guidance, with the rule each one breaks.

Crossing a context threshold can reprice an entire request, not just the tokens above the line. Where the cliffs sit and how to keep prompts underneath.

HubSpot's Contracts API documents GET and batch read only, under a single read scope. Renewals and amendments still run through in-app quote flows.

The 2026-07-28 spec drops the handshake and session ID, reworks auth around CIMD, and ships new Tier 1 SDK releases. Here is what your MCP server has to change.

DeepSeek V4 Flash adds OpenAI's Responses API alongside the Anthropic format it has run since 2025, so Codex CLI or Claude Code needs only a base-URL swap.

REST still powers 83% of public APIs, but GraphQL is in production at 61%+ of enterprises. A 2026 decision matrix by client diversity, team type, and caching.

A 2026 engineering reference for REST API design: RFC 9457 errors, cursor pagination, idempotency keys, versioning, rate limits, and OpenAPI-first workflows.

URL, header, query, and date-based API versioning each fit different contexts. The 2026 engineering decision matrix, with caching trade-offs and a sunset guide.

Five rate-limiting algorithms compared by memory, accuracy, and bursts, plus Cloudflare's production data, GitHub and Stripe limits, and the IETF standard.