📄 Reading: Technical Documentation

403 Forbidden — valid token, insufficient permissions:

The documentation clearly distinguishes between two authentication-related errors:

• 401 Unauthorized → the token is missing or invalid — "Who are you?"
• 403 Forbidden → the token is valid, but the user doesn't have permission — "I know who you are, but you can't do this."

Why this distinction matters: In application code, you handle 401 by redirecting to login. You handle 403 by showing a "permission denied" message — no redirect needed, because the user is already authenticated.

Reading strategy: In API docs, error response tables often have the most important information for developers. Read them carefully — they define the contract between client and server.

Key vocabulary from this doc:

• Path parameter — part of the URL path, e.g., /users/{id}
• Authorization — who has permission to do what
• ISO 8601 — the standard date-time format: 2024-01-15T09:30:00Z

Redis is required only for multi-instance (distributed) deployments:

The README explicitly states this in the Notes section: "Redis is only required for multi-instance deployments where rate limit state must be shared across servers."

Why this matters architecturally:

• In a single-server deployment: the in-memory store tracks request counts locally. Simple, no extra infrastructure.
• In a multi-server deployment (horizontal scaling): if you have 3 servers behind a load balancer, each server has its own memory. Without a shared store like Redis, a user could make 100 requests to Server 1, then 100 more to Server 2 — bypassing the rate limit.

Reading skill: identifying conditions and qualifiers:
Technical docs frequently use language like "only when," "required if," "optional — needed for." These qualifiers are critical — skipping them leads to misimplemented systems.

Key vocabulary:

• middleware — software that connects components; in Express it intercepts requests
• distributed — spread across multiple servers or instances
• in-memory store — data stored in RAM; fast but lost on restart
• rate limiting — restricting how many requests a client can make in a time window

True / False / Not Stated — a classic reading comprehension exercise:

The paragraph states:
✅ "The id field is a string" — TRUE, stated directly
✅ "The created_at field uses ISO 8601 format" — TRUE, stated directly
✅ "There is no rate limiting" — TRUE, stated directly
❌ "A valid token with insufficient permissions returns a 403" — NOT STATED

The paragraph says: "If you send a request with a valid token but the user doesn't have admin permissions, you will receive a 200 OK response."

This is actually incorrect documentation — the proper response should be 403, as shown in the API spec in exercise 1. But as a reading comprehension question, the correct answer is "Not Stated" about 403 — because the paragraph says 200 OK, not 403.

Reading skill — True / False / Not Stated:

• True → explicitly stated or clearly implied in the text
• False → contradicts something stated in the text
• Not Stated → neither confirmed nor contradicted — the text simply doesn't mention it

This distinction is especially important in technical reading: don't bring in outside knowledge. Answer based only on what the text says.