109
votes
Accepted
Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?
This is a great question, and still highly relevant given the historical context (and seemingly contradictory definitions) of the HTTP return codes. Even among the answers to this question there are ...
- 1,966
102
votes
What should be the http status code for "Service not available in your area" error?
Any HTTP error code would be inappropriate. There is no error or problem of any sort from an HTTP perspective so it should be something in the 200 range. You politely inform some of your users that ...
- 18.5k
94
votes
What HTTP status code to return if multiple actions finish with different statuses?
My vote would be to split these tasks into separate requests. However if too many round trips are a concern, I did come across HTTP response code 207 - Multi-Status
Copy/paste from this link:
A Multi-...
- 1,078
87
votes
What should be the http status code for "Service not available in your area" error?
5xx errors are server errors - something went wrong on the server. In particular, a 503 indicates that:
the server is currently unable to handle the request due to a temporary overload or scheduled ...
- 3,572
55
votes
Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?
I read the first answer and didn't really agree with it because, at least in my reading, a bad request (400) means, "I can't even handle your request because something is fundamentally wrong." And I ...
- 859
47
votes
What should be the http status code for "Service not available in your area" error?
Neither of those.
If your API is well-designed, the URL includes the name of the city, e.g.
http://example.com/API/Vienna/HailRide
or
http://example.com/API/HailRide?city=Vienna
since IP ...
- 9,818
42
votes
What belongs in an HTTP request header vs the request body?
While the line is somewhat blurry, for me a rule of thumb is: data that your business logic works on should be in the body, metadata can/should be put in headers.
Another way of looking at it is: ...
- 3,534
36
votes
Accepted
What HTTP status code to return if multiple actions finish with different statuses?
The short, direct answer
Since the request speaks of executing the list of tasks (tasks are the resource that we're speaking of here), then if the task group has been moved forward to execution (that ...
- 568
28
votes
Use 404 or 200 when null result (REST)
HTTP status codes in the 4xx range signify client errors. So I don't think that using a 404 is applicable here. If you were to consider it a client error, then you also say that the client must have ...
- 8,976
27
votes
Why PATCH method is not idempotent?
PATCH requests describe a set of operations to be applied to a resource, if you apply the same set of operations twice to the same resource, the result may not be the same. This is because defining ...
- 457
27
votes
Accepted
RESTful API and i18n: how to design the response?
You've described two effective ways of asking for multiple languages. Either should work fine. I would choose the explicit language request parameter for my own code.
TL;DR Backstory
There is an ...
- 9,790
27
votes
Accepted
REST endpoint to show a preview before POSTing
This is too domain-specific to have a native support in HTTP.
Instead, you may do one of the following:
Have a POST /api/config/preview. At server side, the application will know that it shouldn't ...
- 136k
27
votes
What should be the http status code for "Service not available in your area" error?
This seems like a round hole/square peg question. Why does your only response need to be an HTTP code? HTTP error codes can't possibly cover all use cases.
All of your API calls should have ...
- 457
27
votes
Pattern Matching on Request Body for Routing an HTTP Request
What you're asking is essentially having the mailman deliver the packages differently based on what's inside the package. The mailman should not be looking in there.
Other information, such as the URL,...
- 54.9k
25
votes
RESTful API. Should I be returning the object that was created / updated?
Referencing to the link RFC standards, you should return 201(created) status on successfully storing the request resource using Post. In most of the applications the id of the resource is generated by ...
- 379
24
votes
What HTTP status code to return if multiple actions finish with different statuses?
Allthough multi-status is an option, I would return 200 (All is well) if all requests succeeded and an error (500 or maybe 207) otherwise.
The standard case should usually be 200 - everything works. ...
- 1,301
22
votes
Accepted
Handling token renewal / session expiration in a RESTful API
This sounds like a case of authentication versus authorization.
JWTs are cryptographically signed claims about the originator of a request. A JWT might contain claims like "This request is for user X"...
- 4,519
21
votes
Accepted
What should I do when optimistic locking doesn't work?
The ETag mechanism specifies only the communication protocol for optimistic locking. It's the responsibility of the application service to implement the mechanism to detect concurrent updates to ...
- 12.4k
20
votes
HTTP Status Code for "Still Processing"
I found the suggestions from this blog reasonable: REST and long-running jobs.
To summarize:
The server responds to job requests with 202 Accepted and the Location header field set to the URI of the ...
- 309
20
votes
Should I return an HTTP 400 (Bad Request) status if a parameter is syntactically correct, but violates a business rule?
No, you should not. HTTP codes are meant for the HTTP layer of your application. Business rules is completely different layer and is application specific, so you need to come up with your own "...
- 317
19
votes
Why PATCH method is not idempotent?
I think clear answer when PATCH in not idempotent is this paragraph from RFC 5789:
There are also cases where patch formats do not need to operate from a
known base-point (e.g., appending text ...
- 291
17
votes
Handling token renewal / session expiration in a RESTful API
Your API session is a thing which should not exist in a RESTful world at all. RESTful operations are supposed to be stateless, session contains state and thus has no place in a RESTful world.
The JWT ...
- 10.4k
16
votes
Accepted
Not prohibited, but disallowed -- which http error code should I return?
That sounds like a straightforward 403
You are implementing a rule to ban access to a resource for an unauthorised user - that's a 403
- 294
15
votes
Accepted
How can I protect the user password?
Who can press F12 to see the password?
The person operating the web browser. Who is the same person who just entered that password.
That a user can see their own password in the browser developer ...
- 51.3k
14
votes
What HTTP status code to return if multiple actions finish with different statuses?
One option would be to always return a status code 200 and then return specific errors in your JSON document body. This is exactly how some APIs are designed (they always return a status code 200 and ...
- 255
14
votes
Accepted
What reasons are there AGAINST using only POST HTTP verb in an API?
"What reasons are there AGAINST using only POST HTTP verb in an API?"
You have answered your own question:
The goal is to be very quick and easy to adapt and use for other developers...
If your ...
- 3,123
13
votes
Can a caller abort an execution of code invoked by HTTP request?
HTTP doesn't work like that. The client sends a request, then the server sends a response back. No other communication occurs. Well, the server can send 1xx informational responses before the main ...
- 135k
13
votes
What should I do when optimistic locking doesn't work?
You have to execute the following pair atomically:
checking of the tag for validity (i.e. is up to date)
updating the resource (which includes updating its tag)
Others are calling this a ...
- 34.3k
13
votes
Is it worth logging HTTP requests when they enter an API server?
What is the goal of your logging? Logging request, response, and user info is perfectly valid if your goal is to build a profile of your users. Google certainly does.
If all you want to do is debug ...
- 112k
12
votes
What should be the http status code for "Service not available in your area" error?
A few make sense.
403 Forbidden, for the reasons that Eric Stein mentions in his answer. You can use various information provided by the request to determine where the client is and who the client is ...
- 83.7k
Only top scored, non community-wiki answers of a minimum length are eligible