Hey @quetwo and anyone looking to build APIs... I read in the CommandBox docs that the REST implementation is something you either love or hate. I do see their point. But after doing some testing, I am now in the camp that loves it, at least with Lucee. First, I built a docker image that modifies the web.xml files and changes the word REST to API. Then built a simple endpoint like this... mydomain.com/api/users/12345 Then made it really complicated like this... mydomain.com/api/users/12345/system/ABC123/feedback?limit=50 All without the overhead of a framework, priceless. So thanks again for sharing your video quetwo :)

That's a great video, great for a quick and dirty api, a great starting point for your first api. I used to use the out of the box cf api, but needed more access to the request processing, router internals etc. Then moved to taffy, then wanted more, so now wrote our own lightweight layer, that runs api and web app from single codebase. there's lots missing from a production implementation there, no security, no validation, formatting tools, versioning. You get all of that with api manager if you pay for ACF enterprise. as 'overhead of a framework' our framework (teamcfml) takes 120ms to load (with 10 services, 4 applications, 20 modules and 10 providers and 20 utility modules (formatters, etc) loaded.)

For my use case, I'm not needing a monolith that has both frontend and backend. I just need a stateless API that connects to a database and spits out JSON, nothing more exciting than that. Frameworks are great for building MVC monoliths, and I do encourage their use. But for this, I don't need it. Think in terms of serverless functions, but hosted on a server using docker instead. Security? Sure, add bearer token authentication CORS? Sure, add a couple lines of code. JSON formatting? Sure, its baked in Versioning? Sure, create a new docker image. Further with CFML, we get all those wonderful BIFs we all love.

did you consider just doing a rewrite via the webserver?

Hey @zackster , your comment got me thinking. If Lucee had the opportunity, would it keep or remove that REST implementation? I have no idea how popular it might be. Thanks!

it's not going anywhere

Ah, interesting, and that makes sense. Thank you!

I didn't cover security in that video (I think I mentioned it in passing), but it's not overly hard to bake in. We have our own oAuth 2.0 setup, so we just call the right function, grabbing the bearer headers from the GetHTTPRequestData() method. But also, if the DB connection is warm, we often respond to single record requests in our app in about 6ms. Larger recordsets slow down a bit because of the serialization, but one of my REST endpoints serves about 1M records with 16 fields (pulled via ORM w/caching) in about 30ms + transfer time. As far as versioning -- that's all in the path declaration. There really isn't anything special about that. Like I said, some things like rate limiting, or if you want out of the box auth, you can look toward the API manager or some of the frameworks. I've never been a huge fan of Taffy (just a few things that bugged me about it -- and doing the rewrite rules were a pain)