Python APIs, JSON and LLM Responses

Quick Start

The first version works only with titles written inside its Python file. Tomorrow a title may be added, removed or become unavailable in India. Editing the code for every catalogue change is not practical, so the Python application must ask another service for current data.

This Byte follows one complete exchange: Python prepares a request, the service returns an HTTP status and JSON body, and Python decides whether the response is safe to use. You will see why “request succeeded” and “data is valid” are two different checks.

CONNECT SAFELY

Byte outcome

Connect the Movie Discovery Assistant to an external catalogue, convert the JSON response into Python data, and fail clearly when the service is slow, unavailable or returns an unexpected shape.

PYTHON LEARNING LAB 02

Inspect a real request, response and validation decision

Choose a provider response. The HTTP status and JSON body answer different questions, so Python checks both.

CODE → BEHAVIOUR → OUTPUT

PYTHON REQUEST

requests.get(
  "/v1/titles",
  params={"language": "Tamil"},
  timeout=10
)

PROVIDER RESPONSENot sent

Response will appear here

PYTHON DECISIONStatus check + JSON validation

Transport and data validation stay separate.

Start from Basics

Term	Meaning	Example
Client	Application making the request	Python movie assistant
Endpoint	Address for one capability	`/v1/titles/search`
Method	Requested operation	`GET` or `POST`
Header	Request metadata	authorisation, content type
Body	Data sent with the request	viewer filters
Status code	Transport-level outcome	`200`, `404`, `429`, `500`
JSON	Text format for structured data	title, rating and runtime fields

An API is a contract. It defines what the client may send, what the service returns, and how failures are represented.

Core Explanation

PYTHON

01import requests0203response = requests.get(04    "https://api.example.com/v1/titles",05    params={"language": "Tamil", "rating": "U"},06    timeout=10,07)08response.raise_for_status()09titles = response.json()

CODE RESULTSIMULATED RESPONSE

TRACE THE EXECUTION

EXPECTED OUTPUT

HTTP 200 OK
[{"id":"mv-101","language":"Tamil","rating":"U"}]

VISUAL EXECUTIONFollow the value through the program

Python clientGET + filters

HTTP serviceWait ≤ 10 seconds

Parsed JSONPython list

Always add a timeout. raise_for_status() catches HTTP failures, but a successful status does not prove the JSON contains the fields or values your application expects.

PYTHON

01def validate_title(data: dict) -> dict:02    required = {"id", "name", "rating", "runtime_minutes"}03    missing = required - data.keys()04    if missing:05        raise ValueError(f"Missing fields: {sorted(missing)}")06    if data["runtime_minutes"] <= 0:07        raise ValueError("runtime_minutes must be positive")08    return data

CODE RESULTVALIDATION RESULT

TRACE THE EXECUTION

EXPECTED OUTPUT

Accepted: mv-101
Rejected: Missing fields: ["runtime_minutes"]

VISUAL EXECUTIONFollow the value through the program

Parsed objectExternal data

Required checksFields + values

DecisionAccept or reject

Keep provider keys outside code:

PYTHON

01import os02api_key = os.environ["CATALOGUE_API_KEY"]

CODE RESULTSAFE RUNTIME RESULT

TRACE THE EXECUTION

EXPECTED OUTPUT

CATALOGUE_API_KEY loaded
Value hidden from output and logs

VISUAL EXECUTIONFollow the value through the program

Secret storeProtected value

Runtime environmentInject when starting

Python processRead by name

Do not commit .env, print secrets in logs, or expose a server-side key in browser JavaScript.

Handle temporary failures with a bounded retry—not an endless loop:

PYTHON

01import time0203for attempt in range(1, 4):04    response = requests.get(url, timeout=10)05    if response.status_code != 429:06        response.raise_for_status()07        break08    time.sleep(attempt * 2)09else:10    raise RuntimeError("Catalogue is temporarily unavailable")

CODE RESULTRECOVERY AFTER A TEMPORARY FAILURE

TRACE THE EXECUTION

EXPECTED OUTPUT

Attempt 1 → HTTP 429
Wait 2 seconds
Attempt 2 → HTTP 200
Result → 1 verified title

VISUAL EXECUTIONFollow the value through the program

First call429 rate limited

Bounded retryWait + try once more

RecoveredValidated response

Architecture / Flow Diagram

API REQUEST LIFECYCLECall an AI service without trusting every response

FOLLOW THE FLOW

Python appPrepare request

APISend securely

LLMReturn JSON

ValidateAccept or recover

Remember: HTTP success only means the request completed; your code must still validate the response.

The request crosses a trust boundary twice: data leaves your application and external data returns. Validate what goes out, limit what you disclose, and validate what comes back.

Types / Components

Component	Job	Failure to plan for
Request builder	URL, method, headers and body	sending unnecessary private fields
HTTP client	connection, timeout and response	network timeout
Authentication	proves the caller’s identity	expired or missing key
JSON parser	converts text to Python values	malformed JSON
Validator	checks required business fields	missing or invalid values
Retry policy	repeats selected temporary failures	retry storm
Error mapper	returns a useful application error	leaking provider details

Async Python helps when one request waits for several independent network calls. It does not make CPU-heavy work faster and does not remove provider limits.

Tool / Technology Comparison

Option	Use it when	Watch for
`requests`	simple synchronous scripts and services	each call blocks its worker
`httpx`	sync/async clients and modern timeout control	still needs validation and retry policy
provider SDK	convenient model-specific features	tighter vendor coupling
direct REST	you want explicit HTTP contracts	more request/response code
webhook	provider sends an event later	authenticate and prevent duplicate handling

Choose from the application’s concurrency and portability needs, not from popularity alone.

Real-World Examples

BEFORE → ENGINEERING ACTION → VISIBLE RESULTFollow the problem until the team can prove the result.

Catalogue request

Before: The API key is pasted into source code.
Engineering action: Load it from the runtime environment.
Evidence after: The repository contains no credential.

RESULT VERIFIED

Slow provider

Before: A request waits forever during an outage.
Engineering action: Add a timeout and bounded retry policy.
Evidence after: The app recovers or fails clearly.

RESULT VERIFIED

Changed response

Before: The provider removes a required field.
Engineering action: Validate the parsed JSON contract.
Evidence after: Bad data stops before reaching the UI.

RESULT VERIFIED

These scenarios describe observable application behaviour—not private claims about any company’s internal systems.

A food-delivery app checks restaurant availability, a payment service checks transaction status, and an AI application calls a model provider. The domain changes; the reliability pattern stays: timeout, validate, recover and observe.

Imagine Pannunga

SEE IT IN PRACTICE

An API works like ordering through a waiter

A customer uses an agreed menu and gives the waiter a clear order. The waiter carries it to the kitchen and returns the result. The customer does not enter the kitchen or control its equipment. An API provides the same controlled interface between applications.

Simple Tanglish: Customer direct-ah kitchen-kulla pogama waiter-kitta clear order kuduppaar. Adhe madhiri Python app, API contract moolama service-kitta request anuppi response receive pannum.

Use Cases

WHO USES THIS — AND WHAT DO THEY OWN?Connect each concept to an engineering responsibility.

Backend developer

Build resilient API clients

Clear ownership

Security engineer

Protect credentials and private payloads

Clear ownership

SRE engineer

Control timeouts, retries and limits

Clear ownership

QA engineer

Simulate provider failures and schema changes

Clear ownership

One Python AI application is a team system: code, quality, security and operations work together.

Practical task

Build get_movie_suggestions(profile). Send only language, rating, genre and available time. Apply a 10-second timeout, validate the JSON fields and handle timeout, 401, 429, 5xx and invalid response cases separately.

Retry only failures likely to be temporary—selected timeouts, 429 and 5xx responses—with exponential backoff, jitter and a maximum attempt count. Do not retry invalid credentials or malformed requests.

Key Takeaways

REMEMBER THIS

Key takeaways

An API is an explicit contract between a client and a service.
Method, URL, headers and optional body form the request.
Status codes describe transport outcomes, not business correctness.
JSON becomes Python data only after parsing.
External responses need schema and business-rule validation.
Secrets belong in runtime configuration, never source or browser code.
Timeouts and bounded retries prevent dependencies from consuming resources forever.
Async improves waiting concurrency, not provider capacity or CPU speed.

Final Thought + Next Path

Connecting an API is easy; making that dependency safe is the engineering work. Your application now knows how to send a minimal request, protect its key, validate JSON and recover from common failures. Next, you will combine verified catalogue facts with an LLM to build a grounded Generative AI feature.

FAQ + Knowledge Check

LESSON CHECKPOINTConfirm the concept before moving forward

Choose an answer, inspect the explanation and explain the idea in your own words.

RETENTION

Does status 200 mean the response is safe to use? No. It only confirms HTTP success; validate fields, types and allowed values.

Should every failure be retried? No. Retry only selected temporary failures with limits. Fix authentication and malformed requests.

Where should an API key live? In a runtime environment or managed secret system, not Git, logs or browser code.

When is async useful? When a workflow spends time waiting on multiple independent I/O operations.

Which setting prevents indefinite waiting? A) Timeout B) Loop C) Print
What does a JSON object become in Python? A) Set B) Dictionary C) Tuple
Should 401 be retried repeatedly? A) Yes B) No C) Only at night
What follows parsing? A) Trust immediately B) Validation C) Delete response
Which data should be sent? A) Entire profile B) Only needed fields C) API key in body

Answers: 1-A, 2-B, 3-B, 4-B, 5-B. Score 4/5 or better before continuing.

Work with APIs, JSON and LLM Responses Using Python

Place an order and check the receipt

Quick Start

Byte outcome

Inspect a real request, response and validation decision

Start from Basics

Core Explanation

Architecture / Flow Diagram

Types / Components

Tool / Technology Comparison

Real-World Examples

Imagine Pannunga

An API works like ordering through a waiter

Use Cases

Practical task

Key Takeaways

Key takeaways

Final Thought + Next Path

FAQ + Knowledge Check

Primary sources

Continue by concept