Glossary

154 terms from Django Beyond the Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

**kwargs: In a `def`, `**kwargs` collects keyword arguments into a dict; in a call, it passes them all on. Views and signal receivers use it so extra arguments don't cause errors.
.delay(): A method on a Celery task that queues it for a worker instead of running it now. You pass plain data such as an order id, as in `send_order_confirmation.delay(13)`.
@action: A DRF decorator that adds a custom action to a viewset, such as `ship` at `orders/<id>/ship/`. `detail=True` makes it work on one object, and `methods` limits the HTTP methods.
@api_view: A DRF decorator that turns a plain function into an API view for the HTTP methods you list. The `menu` function uses `@api_view(["GET"])`.
@override_settings: A Django test decorator that temporarily changes settings for one test or one test class. It is used, for example, to turn on `CELERY_TASK_ALWAYS_EAGER` so tasks run immediately, or to switch to an in-memory cache.
@receiver: A decorator that connects a function to a signal. `@receiver(post_save, sender=Order)` runs the function after each Order save.
@shared_task: The Celery decorator that marks a function as a task. A marked function can be queued with `.delay()` and run by a worker.

A

AbstractUser: The class Django's own `User` is built on. A custom user model inherits from it to get all the usual fields and methods.
ADMINS: A Django setting listing the people who get an email when the site hits an error.
aggregate(): A QuerySet method that turns the whole QuerySet into one summary dictionary, such as the shop's total revenue. The database does the math.
AllowAny: A DRF permission class that lets everyone use a view, signed in or not.
annotate(): A QuerySet method that adds a computed value to each row or group, such as total units per product. Put `.values()` before it to say what to group by.
API (application programming interface), endpoint: An API is a set of URLs that programs call to get or send data, as the Kettle & Crane phone app does. Each such URL is an endpoint.
APIClient: The test client used by DRF's `APITestCase`. It sends and reads JSON, and can sign in a user with `force_authenticate`.
APITestCase: DRF's version of `TestCase` for testing API endpoints. Its `self.client` is an `APIClient`.
APIView: DRF's class-based view for hand-written endpoints. You write one method per HTTP method, and DRF adds authentication, permissions and `Response`.
AppConfig, ready(): An `AppConfig` class in an app's `apps.py` describes the app to Django. Its `ready()` method runs once, after all apps and models have loaded, which is where you import `signals.py` to connect receivers.
as_view(): A method that turns a class-based view into something `path()` can call. For each request it makes a fresh view object and calls the method matching the request.
ASGI, WSGI: The standards for connecting Python web apps to servers. WSGI is the older synchronous one, and ASGI is the asynchronous one that async views work best under.
assertNumQueries: A Django test assertion that fails unless the code in its `with` block runs exactly the given number of database queries. It stops N+1 problems from coming back.
async def: The keyword that defines a coroutine, a function whose waiting can overlap with other work. A view written this way is an async view.
Async ORM: The versions of Django's database methods whose names start with `a`, such as `aget` and `acount`, plus `async for` to loop over a QuerySet. Ordinary database calls are refused inside async code.
Async view: A view written with `async def`. It can wait on several slow services, such as the carrier price lookups, at the same time.
asyncio: Python's standard library for asynchronous code. `asyncio.run` starts a coroutine from plain code, and `asyncio.sleep` waits without blocking.
asyncio.gather: Runs several coroutines at once and returns their results as a list. It takes as long as the slowest one.
AUTH_USER_MODEL: The setting that names the project's user model, such as `"accounts.User"`. It must be set before the first `migrate`.
Authentication class, permission class: In DRF, an authentication class works out who is making the request (cookie, token). A permission class then decides whether that user may do it.
await: A keyword used inside a coroutine to run another coroutine, letting other work go ahead while it waits.

B

Background task, task queue: A background task is work done outside the request, such as sending a confirmation email. The task queue is the list of tasks waiting for a worker.
basename: An argument to `router.register` that gives a viewset's URL names a stem when the viewset has no `queryset` to take it from. `staff-order` gives names like `staff-order-list`.
BasePermission: The class DRF permission classes inherit from. You override `has_permission` or `has_object_permission` to return True or False.
Broker, worker: The broker is the service that holds the queue of waiting tasks, which is Redis here. A worker is a separate process that takes tasks off the queue and runs them.
Browsable API: DRF's HTML view of an API, which lays out the JSON with its status and headers so you can try it in a browser. Programs still get plain JSON.
bulk_create(): A QuerySet method that saves a list of new objects with one INSERT. It sends no signals.

C

Cache invalidation: Removing a cached value when the data behind it changes, so later requests don't get stale data. For example, signal receivers can delete the `menu` and `sales-summary` cache keys whenever a product changes.
Cache, stale data: A cache keeps a computed answer for a while so later requests can reuse it. The cost is stale data, an answer that is out of date.
cache.get_or_set: Returns the cached value, or calls the function you give it and caches the result. Pass the function without brackets so it runs only when needed.
cache.set, cache.get, cache.delete: The basic cache calls. `set` stores a value for a number of seconds, `get` returns it (or `None` once gone), and `delete` removes it.
cache_page: A decorator that caches a view's whole response for a number of seconds. It helps on pages that look the same for everyone.
CACHES: The Django setting that says which cache backend to use and how to connect to it. For example, it can point Django's cache at Redis through `RedisCache`.
captureOnCommitCallbacks: A test helper that runs `on_commit` functions when its block ends. It is needed because a `TestCase` never really commits.
Celery: The usual Python task queue for Django. A worker process runs the tasks that the web app queues.
celery -A config worker -l info: The command that starts a Celery worker. `-A config` names the app and `-l info` logs each task.
Celery beat: The part of Celery that sends tasks on a schedule set in `CELERY_BEAT_SCHEDULE`. Run it with `celery -A config beat -l info`.
CELERY_TASK_ALWAYS_EAGER: A setting that makes `.delay()` run the task immediately in the test, so no worker is needed.
check --deploy: A Django command that lists security and deployment problems in your settings, such as a missing HTTPS redirect.
Class-based view, generic view: A class-based view answers requests with methods such as `get` and `post`. A generic view is a ready-made one, such as `ListView`, for a job many sites repeat.
CONN_HEALTH_CHECKS: A database setting that checks a kept-open connection still works before it is reused.
CONN_MAX_AGE: A database setting that keeps each worker's connection open for that many seconds and reuses it, instead of opening a new one for each request.
context_object_name: An attribute of `ListView` that sets the template variable name for the objects. Without it they arrive as `object_list`.
Coroutine: What calling an `async def` function gives back, an object that must be run with `await`. It lets other work proceed while it waits.
CreateView: A generic view that shows a form on GET and, on a valid POST, saves a new object and redirects.
crontab: A Celery schedule helper that runs a task at set clock times, such as `crontab(hour=7, minute=0)` for 7:00 every day.
CSRF_TRUSTED_ORIGINS: A setting listing the full `https://` addresses allowed to send forms to the site. Django checks each form's origin against it over HTTPS.
curl: A command-line tool that sends HTTP requests and prints the response. It lets you call an API without a browser.
Custom user model: Your own `User` class, set with `AUTH_USER_MODEL`. Starting a new project with one avoids a painful change later.

D

DATABASES: The Django setting that says which database to use and how to connect to it, including the engine, name, user, password, host and port. It can be changed from SQLite to PostgreSQL, for example.
dbshell: A command that opens psql connected with the database settings from `settings.py`.
DefaultRouter: A DRF router that creates the URLs for registered viewsets, plus a root page at `/api/` linking to each resource.
DetailView: A generic view that shows one object, found by `pk` or `slug` from the URL. It gives a 404 if there is none.
Django REST Framework (DRF): The standard package for building REST APIs in Django. It provides serializers, API views, viewsets and permissions.
django-filter: A third-party package that filters lists using URL parameters, without writing a custom `get_queryset`. It is commonly used with Django REST Framework and Django views.
django-storages: A package that, with the `STORAGES` setting, lets Django keep media files in object storage such as S3. Models and templates stay the same.
drf-spectacular: A third-party package that generates an OpenAPI description and a documentation page for a Django REST Framework API.
drf_create_token: A management command that makes an API token for a user, for example `python manage.py drf_create_token maya`.
dumpdata: A management command that writes database contents to a file such as `data.json`. `loaddata` reads the file back into another database.

E

enctype="multipart/form-data": A form attribute that makes the browser send the bytes of uploaded files as well as text. Without it the photo is not saved.
exists(): A QuerySet method that only asks whether at least one row matches. It is cheaper than `count() > 0`.

F

F expression: A way to name a column so the database uses each row's own value, even in arithmetic like `F("quantity") * F("product__price")`.
FileExtensionValidator: A built-in validator that limits uploaded files by extension, such as `allowed_extensions=["pdf"]`.
FileField: A model field that stores any uploaded file, such as a PDF. `ImageField` is a version that also checks the file is an image.
Fixture: A file of data, such as `orders.json`, that `loaddata` or a test class's `fixtures` list loads into a database.
force_authenticate: A method on DRF's test client that signs a user in for later requests without a password or token.
form_valid(): A form view method that runs once the form is valid. In `NewOrder` it sets the customer on the unsaved order, then calls the parent's version to save it.

G

get_context_data(): The view method that builds the dict of values passed to the template. You override it, calling `super()`, to add extra values.
get_queryset(): A view method that returns the objects the view works on. You override it to filter, for example to show only the user's own orders.
get_success_url(): A form view method that returns where to redirect after saving, which can depend on the saved object.
get_user_model(): A function that returns the project's user model. Use it instead of importing `User` directly in a project with a custom user model.
gunicorn, uvicorn: Production servers. gunicorn runs WSGI apps and uvicorn runs ASGI apps, each starting several worker processes.

H

has_perm: A user method that checks one Django permission, such as `"orders.change_order"`. A superuser always passes.
has_permission, has_object_permission: Two methods of a DRF permission class. `has_permission` runs for every request before any object is fetched, and `has_object_permission` runs once a detail view has its object (the `IsOwner` class uses it to compare the order's customer with the user).
Host addresses (127.0.0.1, 0.0.0.0): 127.0.0.1 is your own computer, so only you can reach a server bound to it, as with `runserver` and curl. 0.0.0.0 means "accept connections on every network address", which lets other machines reach gunicorn.
HTTP status codes: Three-digit numbers a server sends to say how a request went. Common ones are 200 OK (it worked), 201 Created (a new object was made), 400 Bad Request (invalid data), 401 Unauthorized (the server doesn't know who you are), 403 Forbidden (you are signed in but not allowed), 404 Not Found (no such page or object), 405 Method Not Allowed (wrong HTTP method for the URL) and 409 Conflict (the request clashes with the current state, such as shipping an order twice).
HTTPS, HSTS: HTTPS is HTTP over an encrypted connection. HSTS tells browsers to use only HTTPS for your site for a set number of seconds.
httpx.AsyncClient: An async HTTP client library that real code would use to call each carrier's API from an async view.

I

Idempotent: Safe to run twice with the same result. A retried confirmation-email task should be idempotent, so the worst case is a second email.
ImageField: A model field for uploaded images, which needs Pillow. The database holds only the file's path while the file sits under `MEDIA_ROOT`.
Index, EXPLAIN: An index is a structure that speeds up lookups, added in a model's `Meta.indexes`. `EXPLAIN`, or `.explain()` in Django, shows the database's plan for a query.
IsAuthenticated: Built-in DRF permission classes. `IsAuthenticated` lets in any signed-in user, `IsAdminUser` only staff, and `IsAuthenticatedOrReadOnly` lets anyone read but only signed-in users write.

J

JSON: A text format for data with objects, like Python dicts, and arrays, like lists. APIs send and receive it.
JsonResponse: Django's response class for returning JSON data from a plain view.
JWT: JSON Web Token, a signed token format used to authenticate API requests. It is an alternative to DRF's built-in database-backed token.

L

Lambda: A small function without a name, written in one expression. `lambda: x` works out `x` only when it is called, which is how `.delay()` is held back until the commit.
ListView: `ListView` is a generic view that shows a list of objects. DRF's `ListAPIView`, `RetrieveAPIView` and `ListCreateAPIView` do similar jobs for JSON.
LocMemCache: A cache backend that keeps values in the memory of the running process. Tests use it so they don't share the real Redis cache.
Logging, logger, handler, level: Python's message system. A logger is a named source, a level (DEBUG to CRITICAL) says how serious a message is, and a handler decides where messages go.
LoginRequiredMixin: Mixins that add a login check or a permission check to a class-based view. Put them first in the parent list.
lookup_field: A viewset attribute that says which model field finds one object in the URL. The product viewset sets it to `"slug"` instead of the default `pk`.

M

mail.outbox: A list that collects the emails sent during a Django test, so a test can check them.
MAILERS: Django 6.1's setting that chooses how email is sent, such as the console backend in development or SMTP in production.
management commands: Custom command-line jobs you write for a Django project and run with `python manage.py <name>`. They are used for tasks such as data cleanups or imports.
Media files: Files users upload while the site runs, as opposed to static files you ship with the code. `MEDIA_ROOT` is where they are saved and `MEDIA_URL` starts their web addresses.
Mixin, multiple inheritance: A mixin is a small class that adds one feature, like a login check, to the class it is combined with. Python searches multiple parents left to right, so the mixin goes first.
ModelSerializer: A serializer that builds its fields from a model, like a ModelForm. `Meta` names the model and the fields.
ModelViewSet: A viewset for a whole model. `ReadOnlyModelViewSet` gives list and detail actions, and `ModelViewSet` adds create, update and delete.
MultiPartParser: A DRF parser, on by default, that reads files sent as form data, for example with `curl -F`.

N

N+1 problem: One query for a list plus one more for each row, such as fetching each order's product separately. With 500 orders that's 501 queries.
null=True: A model field option that lets the database store an empty value, NULL. `blank=True` is separate and lets forms leave it empty.

O

Object storage: A hosted file store such as Amazon S3. Live sites keep uploads there instead of on the server's disk.
only(): A QuerySet method that fetches just the named columns as model objects. Reading any other field costs one more query per object.

P

Pagination: Splitting a long list into pages. DRF's paginated response has `count`, `next`, `previous` and `results`.
perform_create: A DRF view method that runs once the data is valid. You use it to add data on save, such as `serializer.save(customer=self.request.user)`.
Permission, group: A permission is a named right such as `orders.change_order`; Django makes add, change, delete and view permissions for every model. A group is a named set of permissions that everyone in it gets, such as the Shipping group alex belongs to.
Pillow: The usual Python library for opening and checking images. `ImageField` needs it.
post_save: Built-in model signals. `post_save` is sent right after a save and `pre_save` just before it, so a receiver can still change the object; the delete and many-to-many signals work the same way.
prefetch_related: A QuerySet method for the many side of a relation. It runs one extra query for all related objects and sorts them into place in Python.
Proxy: A server in front of yours that passes requests on. Many hosts handle HTTPS in a proxy and pass plain HTTP to Django.
psycopg: The Python driver that lets Django talk to PostgreSQL.

R

read_only_fields: A serializer option that marks fields as output only, so incoming data cannot set them. It stops customers from marking an order `shipped`.
Redis: A fast in-memory data store. It can serve as Celery's message broker and as Django's cache through `RedisCache`.
request.FILES: Where Django puts files uploaded in a form, next to `request.POST`.
Response: DRF's response class, whose content becomes JSON.
REST: A style of API where each kind of thing, such as products, is a resource with its own URL and the HTTP method says what to do: GET reads, POST creates, PUT replaces, PATCH updates part and DELETE deletes.
Result backend: The place where Celery workers store tasks' return values, set with `CELERY_RESULT_BACKEND` (Redis here). It is what lets `.delay().get()` read an answer.
retry_backoff: Celery task options for retrying failures. `autoretry_for` lists the errors that trigger a retry, `retry_backoff=True` waits longer each time, and `max_retries` sets when to give up.
reverse_lazy: A version of `reverse` that waits until the URL is needed. It is required for class attributes like `success_url`, which run before Django has loaded the URLs.

S

SECURE_PROXY_SSL_HEADER: A setting that makes Django trust the proxy's `X-Forwarded-Proto` header to know a request arrived over HTTPS.
SECURE_SSL_REDIRECT: Settings that send every `http://` request to `https://` and make browsers send the session and CSRF cookies only over HTTPS.
select_related: A QuerySet method that fetches a ForeignKey's object in the same query with a SQL JOIN. It fixes the N+1 problem for orders and their products.
send_mail: Django's function for sending an email, taking subject, message, from address and a list of recipients. `None` as the sender uses `DEFAULT_FROM_EMAIL`.
Seq Scan, Index Scan: Steps in a query plan. A `Seq Scan` reads every row of the table, which is cheaper for tiny tables like the shop's, and an `Index Scan` finds rows through an index.
Serializer: DRF's version of a form. It turns model objects into JSON-ready data and checks incoming data before it's saved.
serializer_class: The attribute on a DRF view naming the serializer to use, in the place of a template.
SessionAuthentication: A DRF authentication class that uses Django's login cookie. It is what the browsable API uses, while apps use tokens instead.
Signal, receiver: A signal is an event Django announces, such as an Order being saved. A receiver is a function that runs when it is sent.
slugify: Django's function that turns text like "Winter Blend" into a URL-friendly `winter-blend`.
SlugRelatedField: Serializer fields for related objects. `StringRelatedField` shows the object's `__str__`, and `SlugRelatedField` lets the app send or read a slug in place of an id.
SMTP: The standard way to send email through your email provider's server.
super(): Gives you the parent class so you can run its version of a method and then add to it. Without it, your method would replace the parent's.
sync_to_async: A wrapper from `asgiref.sync` that lets async code await an ordinary blocking function, such as `order.total`.
Synchronous, asynchronous: Synchronous code waits for each step in turn. Asynchronous code does other work while one job waits.

T

Tasks framework: Django 6's built-in task system, which ships no worker as of October 2026, so Celery is still the usual choice.
TemplateView: A generic view that just shows a template, such as the shop's home page.
Throttling: Limiting how many requests a client may make in a period, set in DRF with `DEFAULT_THROTTLE_CLASSES` and `DEFAULT_THROTTLE_RATES`. Do it before an API goes public.
Token: A long random string that stands in for a username and password. The app stores it and sends it in the `Authorization: Token <key>` header, and `TokenAuthentication` checks it.
Transaction, on_commit: A transaction is a set of changes saved all together or not at all; `transaction.atomic()` runs a block as one. `transaction.on_commit(func)` calls `func` only after that transaction is saved, so a worker never looks for an order that isn't saved yet.

U

UpdateView: Generic views that edit (`UpdateView`) or delete (`DeleteView`) an existing object found by `pk` or `slug`.

V

validate_<field>(): A serializer method that checks one field, like `clean_<field>` in a form. It returns the value, or raises `serializers.ValidationError` to give a 400 response.
Validator: A function that raises `ValidationError` when a value is bad, such as an uploaded photo over 2 MB.
values(): QuerySet methods that return rows as dicts (`values`) or tuples (`values_list`) holding only the fields you name. Before `annotate`, `values` sets the grouping.
Vary: Cookie: An HTTP header telling caches that a page differs per visitor. Django caches one copy per visitor for pages that show the username.
ViewSet, router: A viewset puts all of a resource's actions in one class. A router makes the URLs for them.

W

WhiteNoise: A package that lets Django serve its own static files on any host. Its storage compresses files and adds a fingerprint to each name so browsers can keep them for a long time.
Worker process: One copy of your app running inside a server such as gunicorn, so several requests can be handled side by side.