HTTP defines request/response semantics. Methods such as GET, POST, PUT, PATCH, and DELETE communicate intent, while status codes distinguish success, client errors, and server failures. Idempotency matters during retries: repeating an idempotent operation should have the same intended effect as performing it once.

TLS protects data in transit and authenticates the server through certificates. It does not automatically encrypt data at rest or authorize a user to access a resource. Authentication establishes identity; authorization decides whether that identity may perform an action.

Use timeouts and explicit error responses. A client that waits indefinitely can exhaust its own connection pool and upstream capacity. For operations that create payments or orders, use idempotency keys or deduplication so a retry after an ambiguous timeout does not create duplicate effects.