I have an endpoint GET home/{homeId}/laptops . Its response is :


If homeID does not exist I can return '404 Not found' OR an empty response with the homeId and the laptops array empty such as :


The client does not really care about the error message and in my specific scenario I can query a database by homeId and retrieve the home's laptops so I do not really care if homeId exists because if homeId is not valid nothing will be returned from the database .

Also checking each time if homeId is valid will increase the endpoints cost .

So the question is : are there any http standards that advice what should I do ? Intuitively I would prefer a strict api telling you exactly what is going wrong , however I see an increase in cost here mainly for the sake of convenience ?

Note: I do not care about authorization in this scenario .

1 Answer 1


are there any HTTP standards that advise what should I do?

No, HTTP has very little to say in this case. Basically, you will have to decide whether this false positive meets your requirements for both server and client. Don't forget that the main goal of any API is to be consumed, so look at it from the client's perspective as well.

I see an increase in cost here mainly for the sake of convenience?

An increase in comparison of what? Do you have something that this "convenient" approach would make less performant? Did you get metrics? If not, you might be trying to optimize prematurely. Optimizing things takes having something to optimize in the first place. Something working and proved to have performance issues.

On the other hand, don't underrate for the sake of convenience. This's a good convenience because it means you won't respond to the client with false possitives. When you do, you delegate to the client-side to guess whether it's a false positive or not and what to do with it.1

If homeId doesn't exist and the sever interrupts the request by responding 404 it basically implies that the client should not try adding laptops to that homeId. Should not even be capable of navigating deeper in the hierarchy.2

But, if none of that is a problem for you, then a false positive can be reasonable. The main problem with them (IMO) is that they lead you to build things upon false premises (the pillars of every house of cards).

1: These issues arise when you get metrics and they don't meet the requirements. 2: It could be translated into computational resources savings. Spending computational resources on executions that lead to nowhere seems more costly to me. Those are going to be unnecessary requests to the server and unnecessary resources dedicated to useless responses for the client.

  • I like the false positives part Jun 30, 2022 at 11:43
  • It's similar to successful failures. When you respond with 200 OK {result: KO} to an unsafe request.
    – Laiv
    Jun 30, 2022 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.