Pagination, Versioning & Error Handling

Offset pagination (?page=3&size=20) is intuitive but fragile: if a row is inserted or deleted while a user is paging through results, every subsequent page shifts, and users see duplicates or skip items entirely. Cursor pagination (a token pointing at "the last item you saw") stays stable under concurrent writes, because it doesn't depend on absolute position; it just says "give me what comes after this specific item."

An API you can never change is an API that eventually can't evolve. Common strategies: a version in the URL path (/api/v2/users), a custom header, or a query parameter. Whichever you pick, the discipline that matters is keeping old versions alive for a real deprecation window instead of breaking every existing client overnight.

Use HTTP status codes as they're meant to be used (404 for missing, 401 for unauthenticated, 403 for unauthorized, 429 for rate-limited) and return errors in one consistent shape across every endpoint, so client code can handle failures generically instead of special-casing each one.