We had a interesting debate today over what our REST API should default to doing when validating a request body where unexpected fields are present. I think we ended the conversation in a good place, but it brings up somewhat of a meta point of whether or how to apply Postel's law that'd I'd like to explore further.
Our application is essentially a large and complicated order management, matching, and dispatching system (similar to a ridesharing service). Most of our endpoints are related to actions at various stages in the order input, matching, and management flows, in addition to entity management (CRUD). There's no plans to open this up this API publicly, so the only clients are our mobile and web apps (and potentially scripts we write).
I've written systems in the past where we where we took the liberal approach in accepting fields, where the situation was we were the receiver of an event stream that we had to handle. In that case the API must be liberal in accepting arbitrary fields, as otherwise the upstream producer can't effectively add features or change their system.
However, it seems to me in our case that this is a case where we'd want to be strict in what we accept. All of the users here will be internal developers, so it's hard to imagine many common situations where being permissive buys you reliability over a strict API. We've agreed that there are large improvements in developing vs. a strict API and many bugs that we can avoid by strictly validating during dev, however there are arguments for a permissive API being more reliable in prod by not bombing out on otherwise acceptable requests. However, since we control all the legitimate clients it seems like we shouldn't end up in this situation, except in certain rare cases of client releases that use some fields before the API is ready to consume them. So if we start seeing unexpected fields, we'd at least want to know and likely to error most of the time. Is there a common case I'm missing that where we'd be slowed down by a restrictive API.
There are some difference in background on the team, so some of this might be due to different frames of mind. I'd like to hear and understand other's opinions here as I don't fully buy arguments for permissive being more reliable and us wanting to serve clients who have unexpected fields.