While researching RESTful API frameworks I've come across (generally speaking) two types of frameworks:
The first type will (more or less) directly (or nearly directly) map an ORM/ODM scheme of your database to the resources. For example, tbone.
It does give you options for what fields to expose, as well as the ability to create expose faux fields (e.g. being able to convert an obscure DB enum value to a human readable phrase).
The second type provides the ability to easily define your resources, but you have to fill in the details of what a GET to /users actually does. For example, Flask-RESTful.
The first approach does offer the ability to get up and running faster, however, I have several concerns:
- It seems like you're more locked in. With robust enough tests you'd likely be able to replace the framework but seems risky.
- Are there any security concerns with giving near direct access to the database or names of fields?
Is it safe to use these sorts of frameworks? Or is it a better idea long term to write your APIs from scratch?