** Access tokens
* versioned API (either via URI or the Accept-Header)
* All function/method calls have to be fully-nonblocking. If an expensive call has to be made to a backend system, the client needs to be provided with a status URI which can be checked for the current status
* Input validation must be performed for all data
* Meaningful error message will be presented to the client