Pagination, Filtering & HATEOAS

Offset pagination is simple but slows down at deep pages because the database skips all preceding rows; cursor or keyset pagination stays fast by jumping to the slice after the last seen key.

Expose filtering and sorting through query parameters, but only against a server-side whitelist of allowed fields, because arbitrary column names invite SQL injection, schema leakage, and unindexed sorts.

HATEOAS means responses carry links to the next possible actions so clients navigate by following them, but most APIs skip full HATEOAS because the complexity outweighs the benefit, preferring OpenAPI documentation instead.

HATEOAS means responses carry links telling the client what actions are possible next from the current state, so clients follow links instead of hardcoding URLs.