** Access tokens
* versioned API (either via URI or the Accept-Header)
* All API calls have need to be fully nonblocking. If an expensive call has to be made to a backend system, the client needs to be provided with a status URI which can be checked for the current status
* Input validation must be performed for all data (validation of data happens twice: in the API and the client)
* Meaningful error message will be presented to the client