liveBook · Manning

Arazzo

As explained in Secure APIs

The Arazzo Specification is a standard for describing API workflows, their required steps, and the relationships among those steps.

Arazzo is a standard for describing the API workflows users must follow, including each step and the relationships among steps. It turns a scattered set of endpoints into an explicit user journey that an API can help enforce. section 6.6 section 6.7

This matters when direct API access lets bots skip UI-guided steps. Enforcing the documented flow and tracking the latency between steps can reduce automated business-flow abuse, such as buying scarce stock before legitimate customers. section 6.6

Checkout workflow

A checkout workflow can require GET /products/{product_id}, POST /carts, POST /carts/{id}/price, POST /carts/{id}/delivery-slot, and POST /carts/{id}/payment. An Arazzo document places these steps in a workflow, gives each step an ID, checks success criteria such as status codes, and passes outputs such as cart_id to later steps. section 6.6

How Secure APIs covers it

How deep it goes
Defines specifications, workflows, ordered steps, success criteria, and outputs, then connects them to flow enforcement and interaction tracking.
Examples
Uses an e-commerce checkout flow, Arazzo YAML, skipped-step automation, and a flow tracker for real-user deviations.
What you can do after
Apply it via Arazzo to document ordered API workflows and support enforcement against skipped-step automation.
How it connects
Connects API workflows with OpenAPI specifications, business-flow abuse, automation, and API interaction tracking.

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.