Welcome, Junior Application Designer
Summit Workplace Solutions wants to add an AI-powered support feature to an internal application — something that reads a support ticket and suggests a helpful response. Your job is to design how that feature actually talks to an AI service, safely.
The situation at Summit Workplace Solutions
Nobody's asking you to write production code today. They're asking you to understand the pieces well enough to design a safe workflow: how a request is built, how it's authenticated, what could go wrong, and what should never end up in the wrong place.
Important: nothing here is a real, live API
This lesson never calls a real AI service. Every request, response, error, and API key you'll see is simulated and fictional, built entirely into this page. You will never be asked to enter a real API key anywhere in this lesson.
Essential question
What does it actually take to connect an app to an AI service safely, from request to response?
Estimated time
About 50 minutes, in 12 steps. Your progress is saved automatically, so you can pause and come back.
What you will be able to do by the end of this lesson
- Explain the stages of a simplified API request/response workflow.
- Label the parts of a request and a response.
- Spot and fix simple problems in JSON data.
- Identify exposed API keys and other insecure design choices.
- Decide what data should and shouldn't be sent in a request.
- Design a safe workflow and handle common error responses.
Fourteen Words Behind Every API Call
Read each short explanation, then flip the cards to check your understanding. This part is practice — it is not graded.
Two programs, talking
An application programming interface (API) is a defined way for one piece of software to ask another for information or action. The client sends a request to a specific endpoint on a server, and the server sends back a response. Most of this data travels as JSON — a simple, labeled text format.
Proving who's asking
Authentication proves who's making a request, usually using an API key — a secret code that must never be exposed publicly. Real applications store keys in an environment variable on the server, never inside code that runs in a user's browser.
Keeping things safe and stable
A rate limit caps how many requests a client can make in a given time. Good error handling means the app responds sensibly when something goes wrong. Input validation checks that data is well-formed before it's used. Data minimization means sending only what's actually needed — nothing extra.
Vocabulary check (practice)
Click a card to flip it and see what that term means. Flip through all 14 before continuing.
0 of 14 cards flipped.
Activity 1: Arrange the Workflow
Put the six stages of a simplified API workflow in the correct order. Click a stage below to add it to the next open slot; click a placed stage to send it back.
Correct order (fill top to bottom)
Available stages
Activity 2: Label the Parts
Select a term on the left, then select the part of a request or response it describes on the right. Match all seven pairs.
0 of 7 pairs matched.
Activity 3: Inspect and Correct JSON
Each snippet below has exactly one problem. Identify it.
Activity 4: Identify Exposed API Keys and Insecure Choices
A teammate listed some ideas for handling the API key. Check every one that's an insecure practice.
Activity 5: What Should the Request Include?
The AI support feature only needs a ticket's message text and category to suggest a response. A developer proposed sending the fields below. Check every field that should be removed before this request is ever sent.
Activity 6: Configure the AI Support Workflow
For each design decision below, choose the safest option.
Activity 7: Handle These Error Responses
For each fictional error response, identify what it means and how the app should respond.
Activity 8: Final Secure Workflow Recommendation
A teammate's workflow summary is ready for your review before the team moves forward.
Your recommendation:
0 characters (minimum 40)
Activity 9: Final Knowledge Check
A mixed set of questions covering everything from this lesson.
Reflection & Completion
0 characters · 0 sentences detected (need at least 2)
Your results so far
Total: 0 / 100
Lesson complete
Verification ID:
PDF generation isn't available in this browser, so use the print-friendly report instead — you can print it or save it as a PDF from your browser's print dialog.