I'm still in the design phase of my REST API, and I'm a bit stuck on how to configure the resources. The API will be consumed by mobile devices (Android, iOS, and Windows). Communication through HTTPS.
These are the features the API will support:
- View a list of previous reservations
- View a previous reservation
- Create a new reservation
- Create a new anonymous reservation
I was thinking of naming my resources as following:
- api/users/{id}/reservations (GET)
- api/users/{id}/reservations/{id} (GET)
- api/users/{id}/reservations (POST)
- api/users/0/reservations (POST)
I'm not sure if the resource for 4 is a good design?
Also 1, 2, 3 require a user to have an account and be authenticated. Authentication will be done using an access-token. This means the user has to log in every X period.
Is it bad to store the user id on the device so it is able to perform requests where the user id is required? Or should I just remove the /users/ part from the resource and have the server decide based on the access-token which user is trying to perform a specific action?
The REST API will be built using ASP.NET MVC4.