** Access tokens
** OAuth
* versioned API (either via :** starting with one version number in the URI or , for example: https://api.selfcare.com/v1/customer , corresponding to the Acceptmajor version in SemVer** minor version will be added via Request-Header-Field in future (as-needed)
* All API calls need to be fully nonblocking. If an expensive call has to be made to a backend system, the client needs to be provided with a status URI which can be checked for the current status or preferably be notified via [http://en.wikipedia.org/wiki/WebSocket WebSockets].
* Input validation must be performed for all data (validation of data happens twice: in the API and the client)