9 items
Using the client's ID as the operation ID will eventually point one customer at another customer's job. Key uniqueness on the client plus their value, and enforce authorization on every status call.
A 202 is as easy to return as a 200. What it commits you to is validating before you accept, publishing a way to track the work, and having an answer ready when the work finishes and nobody is listening.
A POST that timed out leaves the caller with nothing safe to do. An Idempotency-Key header, backed by a key derived into the data and a database that rejects duplicates, makes the retry safe.
A health check that fails on slowness is powerful and easy to overdo. If every instance reports unready at once, the load balancer has nowhere to send traffic and your probe caused the outage.
Making an API fast is easy. Making it fast without serving stale data or someone else's data means picking your paging shape before callers depend on it and never letting a cache key forget who asked.
CORS only tells browsers what they may read, and the built-in rate limiter counts per instance. Both work in the demo and leak in production once you forget which assumption you were making.
A 403 tells the caller the thing exists. Which status you return on a denial, where identity comes from, and whether endpoints depend on how roles are issued are all decisions most APIs make by default.
Cleaning up your error handling can break callers. Know which changes are breaking, keep validation rules where they belong, and version from day one so v1 gets deprecated on a schedule instead of broken on a Tuesday.
Controller to service to store means a one-line change touches three folders. Vertical slices fix that, at the cost of some duplication and a conventions problem you should solve early.
