The URI path represents the resource hierarchy.
/organisms/animals/cats/ubuntu
Given the above, all of the following should be valid URIs.
/organisms/animals/cats
/organisms/animals
/organisms
Rules
-
No Trailing Slashes
/cats/ubuntu/
/cats/ubuntu
-
Prefer Lowercase Letters
/cats/ubuntu
is not the same as
/cats/Ubuntu
-
Use Hyphens To Improve Readability. Don't Use Underscores.
/cats/cait_sith
/cats/cait-sith
Query Parameters
-
Filter Collections
/cats?color=black
Return all black cats
-
Paginate collection results
Don't return a large collection all at once.
/cats?pageSize=10&pageStartIndex=50
Resource =/= Representation
A representation is the format used to transfer the resource.
Specify the format using a query paramter
/cats/ubuntu?format=json
HTTP request methods represent CRUD actions
Retrieve a resource's representation.
GET /cats/ubuntu
A GET must NEVER make changes to the resource or have side effects.
Create a new resource at a known URI
PUT /cats/ubuntu
The request body contains a representation of the resource to be created.
{name:ubuntu, color:brown, gender:male}
Modify an existing resource.
PUT /cats/ubuntu
The request body contains a representation of the attributes to modify
{gender:female}
Create a new resource in a collection when the URI is unknown
POST /cats
The request body contains a representation of the resource to be created.
{name:ubuntu, color:brown, gender:male}
Execute a controller
POST /cats/ubuntu/feed
POSTs are unpredictable and resending a POST request can have undesired side-effects.
Remove a resource from it's parent
DELETE /cats/ubuntu
D*:
After a DELETE, the resource should no longer be accessible at it's URI by future requests.
HTTP response status codes should be used to inform the client of the overall result.
200 OK
General-purpose success code, if none of the more specific ones apply.
201 Created
When a new resource has been successfully created.
202 Accepted
Only used by controllers. When a process is asynchronous but it was started successfully.
204 No Content
When the body is intentionally empty, such as for PUT, POST and DELETE requests.
301 Moved Permanently
If the API's architecture has changed and a resource now uses a new URI. The new URI should be specified in the response.
303 See Other
Refers the client to another URI, such as when a controller generates a resource.
307 Temporary Redirect
Tells the client that nothing was done with their request and they should resubmit to the specified URI.
400 Bad Request
General-purpose client-side error code, when no other 4XX code applies.
401 Unauthorized
If a resource requires authorization and there were incorrect or no credentials given.
403 Forbidden
If an authenticated user attempt to access a resource they are not allowed to.
404 Not Found
If the given URI can't be mapped to a resource.
405 Method Not Allowed
If an HTTP method is used on a URI that does not allow it, such as GET on a controller.
500 Internal Server Error
An generic error on the server. 500 means that it wasn't the client's fault and they should resubmit their request.
418 I'm A Teapot
If the client attempts to brew coffee and the HTCPCP Server is a teapot. The resulting body MAY be short and stout.
Sorry, but this is just the tip of the RESTful iceberg.
What else is there?
-
More Methods: HEAD, OPTIONS
-
More Status Codes
-
HTTP Headers
-
Representation Design
-
Security: Basic Authentication, Oauth
-
Versioning
The good news: You're already way ahead of the curve.