* All API calls need to be fully nonblocking. If an expensive call has to be made to a backend system, the client needs to be provided with a status URI which can be checked for the current status or preferably be notified via [http://en.wikipedia.org/wiki/WebSocket WebSockets].
* Input validation must be performed for all data (validation of data happens twice: in the API and the client)
** JSON (or XML) validation has to be done before everything else and the client needs to be informed if he passed invalid syntax(see [http://www.php.net/manual/de/function.json-last-error.php function.json-last-error] and [http://www.php.net/manual/de/function.json-last-error-msg.php function.json-last-error-msg])
* Meaningful error message will be presented to the client
* All API functions are to be documented using an accepted documentation standard (doxygen (preferred), phpDocumentor or Sami)