I'm trying to create an api which has a login that issues a JSON web token and then offers a handful of resources to authenticated requesters.
User is a type of resource, and this is where I get confused about routes. In some cases, authenticated users GET information about other users, like this:
/api/user/<any user id>/favoriteBooks
But in most cases, authenticated users may GET information only about themselves. How should those requests be formed?
A: /api/user/1234/homeAddress
. 1234 must be the caller's user id, and this returns an error if the route user id disagrees with the token user id.
B: /api/user/1234/homeAddress
. 1234 must be the caller's user id, but this version ignores that and just returns the info for the user indicated by the token.
C: /api/user/homeAddress
. same as B, except this one dispenses with the redundant route user id which B ignores anyway.
A seems the most conventional, but contains an unnecessary error path, B seems a little misleading, and requires redundant information that is ignored, and C is most appealing to my intuition, but I've never see routes like this. If a REST route must fully describe the request, then this one would be odd, too.
Is there a strong rule or norm that I can use to guide me here?