Requests, APIs and JSON

Play this lesson

A message flies to a server

Every time Garden Defense loads a save, the phone (the client) sends a request across the internet to a server, and a response comes back, often in under a tenth of a second. The rules both sides follow are called HTTP, invented around 1990 for the first websites.

Every request has a method, a verb for what we want. GET means "give me", like loading the leaderboard. POST means "here is something new", like sending a score. The score travels in the request's body, the part that carries data. DELETE removes something.

URLs, APIs and endpoints

Every request goes to a URL, an address like this one:
https://api.ourstudio.example/v1/scores?top=10

An API (application programming interface) is the menu of requests a server agrees to answer. Each item on the menu, one URL for one job, is an endpoint.

Quick check

A Hyper Shards run ends and the game sends the new score to the server. Which method fits?

  1. GET, because it gets the score ready
  2. POST, because it sends something new in the body
  3. DELETE, because the run is over
Show the answer

POST, because it sends something new in the body

POST sends new data, like a score, inside the request body. GET only asks for something, and DELETE removes something.

Status codes: how did it go?

Every response starts with a three-digit status code. The first digit tells you who to blame.

Read the error

Browser console, Kai's laptop
GET https://api.ourstudio.example/v1/socres?top=10 404 (Not Found)

Kai's leaderboard screen stays empty and the console shows this. What is the most likely cause?

  1. A typo in the path: socres instead of scores
  2. The server is broken and needs a restart
  3. The request worked, the board is just empty
Show the answer

A typo in the path: socres instead of scores

404 means nothing lives at that address, and a 4 means the request was the problem. The path says socres. A broken server would answer with a 5xx code, and success would be 200.

JSON: data as text

The data inside requests and responses is usually JSON (JavaScript Object Notation), a way to write data as plain text that any language can read:

{ "name": "SwiftComet", "score": 48200,
  "boosts": ["shield", "laser"], "verified": true }

The rules are strict. Names (keys) and text go in double quotes. Numbers, true, false and null have no quotes. Square brackets hold lists, curly brackets hold objects. No comments and no comma after the last item.

Bug hunt

run.json
{  "name": "SwiftComet",  "score": 48200,  'ship': "nova",  "verified": true}

The server answers 400 Bad Request when Kai sends this JSON. Which line breaks the JSON rules?

  1. Line 2
  2. Line 3
  3. Line 4
  4. Line 5
Show the answer

Line 4

JSON only allows double quotes. Line 4 uses single quotes around ship, which JavaScript accepts but JSON does not, so the server can't read the request.

Waiting without freezing

A request can take 50 to 300 milliseconds. At 60 FPS that's up to 18 frames. If the game stopped to wait, it would freeze.

In JavaScript, fetch(url) sends a request and hands back a promise: an IOU for an answer that hasn't arrived yet. Inside a function marked async, the word await pauses only that function until the answer arrives. The game keeps drawing frames meanwhile.

const res = await fetch(url);
const board = await res.json();

Read the code

board.js
async function loadBoard() {  const res = await fetch(BOARD_URL);  if (!res.ok) {    showMessage("Board offline, try later");    return;  }  const board = await res.json();  drawBoard(board);}

The server breaks and answers 500. Which line stops the game from trying to draw a broken board?

  1. Line 2
  2. Line 3
  3. Line 7
  4. Line 8
Show the answer

Line 3

res.ok is true only for 2xx codes. Line 3 catches anything else, like 404 or 500, shows a friendly message and returns before line 7 tries to read JSON that isn't there.

An SDK does it for us

Writing every URL, method, header and JSON body by hand is slow and easy to get wrong. So services give us an SDK (software development kit): a ready-made code library for talking to them.

With Firebase's SDK we write one line, like setDoc(ref, save). Under the hood, the SDK builds the request, adds the player's login pass, sends it to Google's servers, reads the response and turns errors into clear messages.

Bolt says: Request, response, status code, JSON. Every cloud feature in this stage is built from those four. Next lesson: planning the data those requests carry.

Fact-checked 9 October 2026