Chapter plan
What you will complete
01Calling External APIs with RestClientUse the modern synchronous RestClient for outbound HTTP; know where WebClient fits and why RestTemplate is legacy.Configure RestClient with base URL, headers, and timeoutsMap error statuses to domain exceptions via the response extractorChoose between RestClient and WebClient by stack, not fashion 30 min02Receiving Webhooks SafelyAccept provider callbacks with verified signatures, timestamp windows, and idempotent handling so replays cannot corrupt state.Verify HMAC signatures over raw request bytesReject stale timestamps to block replay attacksProcess events idempotently with stored event ids to handle at-least-once delivery 30 min03Budget Timeouts, Retries, Circuit Breakers & BulkheadsCompose resilience mechanisms around one caller deadline and idempotency contract.Set connect and response timeouts explicitlyRetry only bounded transient failures with jitterUse bulkheads to protect scarce caller resources 55 min
Module outcome
Integrate a third-party API whose failures do not cascade into your own outage.
Mental model
Every external call is a dependency with its own failure modes; the client code you write is the blast-radius contract.
Module checkpoint
Payment integration slice
Charge through a fake PSP, survive its latency, and accept its webhooks safely.
- Timeout ladder under an end-to-end budget
- Breaker transitions charted under fault injection
- Forged webhook rejected by signature check
Final module assessment
Ready to prove mastery?
Complete all 50 questions after finishing the module lessons and checkpoint.