Create a small Express 5 REST API with JSON parsing, resource routes, async handlers, HTTP semantics, and a centralized error response.
What you will build
This tutorial produces a working, verifiable result rather than a command list. Read each command before running it, keep configuration in version control without secrets, and record the versions used for repeatable deployment.
1. Prepare the project
mkdir express-api && cd express-api
npm init -y
npm pkg set type=module scripts.start='node server.js'
npm install express@5
Run preparation commands as an unprivileged application user unless a command explicitly requires sudo. A clean working tree and lockfile make rollback much easier.
2. Implement the solution
import express from 'express';
const app=express(); const items=new Map();
app.use(express.json({limit:'100kb'}));
app.get('/api/items',(req,res)=>res.json([...items.values()]));
app.post('/api/items',(req,res)=>{const id=crypto.randomUUID(); const item={id,name:req.body.name}; items.set(id,item); res.status(201).location(`/api/items/${id}`).json(item);});
app.get('/api/items/:id',(req,res)=>{const item=items.get(req.params.id); item?res.json(item):res.status(404).json({error:'not_found'});});
app.use((err,req,res,next)=>{console.error(err); res.status(500).json({error:'internal_error'});});
app.listen(3000,'127.0.0.1');
Save the example in the filename indicated by its comment or surrounding instructions. Treat it as a minimal baseline: production applications should separate transport, business logic, persistence, and configuration into testable modules.
3. Verify end to end
npm start
curl -sS http://127.0.0.1:3000/api/items
curl -i -X POST http://127.0.0.1:3000/api/items -H 'content-type: application/json' -d '{"name":"keyboard"}'
Verification should cover both process state and a real request or data operation. A process that is merely running is not necessarily ready to serve traffic.
4. Troubleshooting and production notes
An in-memory Map is only for this lab; multiple processes need shared durable storage. Validate name before insertion, add authentication where required, and never return raw database or framework errors to clients.
Production checklist
- The supported Node.js LTS version and dependency lockfile are recorded.
- Configuration is validated at startup and secrets are stored outside source control.
- Input limits, authentication, authorization, timeouts, and error boundaries are explicit.
- Logs identify a request without exposing credentials or personal data.
- Health checks, graceful termination, resource limits, backup, and rollback have been tested.
Reference: official topic documentation. For production version selection, use a supported LTS line from the Node.js release schedule.
