** Access tokens
* versioned API (either via URI or the Accept-Header)
* All API calls need to be fully nonblocking. If an expensive call has to be made to a backend system, the client needs to be provided with a status URI which can be checked for the current statusor preferably be notified via [http://en.wikipedia.org/wiki/WebSocket WebSockets].
* Input validation must be performed for all data (validation of data happens twice: in the API and the client)
* Meaningful error message will be presented to the client