But for now, let's check these important **conceptual ideas**. These concepts also apply to any other type of web API. 💡

## Security - HTTPS { #security-https }

In the [previous chapter about HTTPS](https.md){.internal-link target=_blank} we learned about how HTTPS provides encryption for your API.

We also saw that HTTPS is normally provided by a component **external** to your application server, a **TLS Termination Proxy**.

///

/// note | Technical Details

You could also use `from starlette.requests import Request`.

**FastAPI** provides it as a convenience for you, the developer. But it comes directly from Starlette.

///

### Before and after the `response` { #before-and-after-the-response }

You can add code to be run with the `request`,  before any *path operation* receives it.

And also after the `response` is generated, before returning it.

// He works in a Company (belongs to), he has a Manager (belongs to - single-table), and also managed a Team (has many - single-table)
// He speaks many languages (many to many) and has many friends (many to many - single-table)
// His pet also has one Toy (has one - polymorphic)
// NamedPet is a reference to a named `Pet` (has one)
type User struct {
	gorm.Model
	Name      string

    /**
     * Indicates whether Maven should also build the specified projects' dependencies.
     *
     * @return an {@link Optional} containing true if dependencies should also be built, false if not, or empty if not specified
     */
    @Nonnull
    Optional<Boolean> alsoMake();

    /**
     * Indicates whether Maven should also build the specified projects' dependents.
     *

 * </p>
 * <p>
 * The mojo class can also be injected with an {@link Execute} annotation to specify a
 * forked lifecycle.
 * </p>
 * <p>
 * The {@link Parameter} annotation can be added on fields to inject data
 * from the plugin configuration or from other components.
 * </p>
 * <p>
 * Fields can also be annotated with the {@link Resolution} annotation to be injected

`HTTPException` is a normal Python exception with additional data relevant for APIs.

Because it's a Python exception, you don't `return` it, you `raise` it.

The spec also states that the `username` and `password` must be sent as form data (so, no JSON here).

### `scope` { #scope }

The spec also says that the client can send another form field "`scope`".

/// note | Technical Details

A `Request` has a `request.scope` attribute, that's just a Python `dict` containing the metadata related to the request.

A `Request` also has a `request.receive`, that's a function to "receive" the body of the request.

The `scope` `dict` and `receive` function are both part of the ASGI specification.

        }
        val functionalTestsPass =
            functionalTestProjects.map { functionalTestProject ->
                FunctionalTestsPass(model, functionalTestProject).also { ******@****.***ype(it) }
            }

        functionalTests = topLevelFunctionalTests + functionalTestsPass
        crossVersionTests =

This schema definition includes your API paths, the possible parameters they take, etc.

#### Data "schema" { #data-schema }

The term "schema" might also refer to the shape of some data, like a JSON content.

In that case, it would mean the JSON attributes, and data types they have, etc.

#### OpenAPI and JSON Schema { #openapi-and-json-schema }