rest-patterns

REST Patterns

Quick reference for RESTful API design patterns and HTTP semantics.

HTTP Methods

| Method | Purpose | Idempotent | Cacheable | |--------|---------|------------|-----------| | GET | Retrieve resource(s) | Yes | Yes | | POST | Create new resource | No | No | | PUT | Replace entire resource | Yes | No | | PATCH | Partial update | Maybe | No | | DELETE | Remove resource | Yes | No |

Essential Status Codes

| Code | Name | Use | |------|------|-----| | 200 | OK | Success with body | | 201 | Created | POST success (add Location header) | | 204 | No Content | Success, no body | | 400 | Bad Request | Invalid syntax | | 401 | Unauthorized | Not authenticated | | 403 | Forbidden | Not authorized | | 404 | Not Found | Resource doesn't exist | | 422 | Unprocessable | Validation error | | 429 | Too Many Requests | Rate limited | | 500 | Server Error | Internal failure |

Resource Design

GET    /users              # List
POST   /users              # Create
GET    /users/{id}         # Get one
PUT    /users/{id}         # Replace
PATCH  /users/{id}         # Update
DELETE /users/{id}         # Delete

# Query parameters
GET /users?page=2&limit=20          # Pagination
GET /users?sort=created_at:desc     # Sorting
GET /users?role=admin               # Filtering

Security Checklist

• [ ] HTTPS/TLS only
• [ ] OAuth 2.0 or JWT for auth
• [ ] Validate all inputs
• [ ] Rate limit per client
• [ ] CORS headers configured
• [ ] No sensitive data in URLs
• [ ] Use no-store for sensitive responses

Common Mistakes

| Mistake | Fix | |---------|-----| | Verbs in URLs | /getUsers → /users | | Deep nesting | Flatten or use query params | | 200 for errors | Use proper 4xx/5xx | | No pagination | Always paginate collections | | Missing rate limits | Protect against abuse |

Quick Reference

| Task | Pattern | |------|---------| | Paginate | ?page=2&limit=20 | | Sort | ?sort=field:asc | | Filter | ?status=active | | Sparse fields | ?fields=id,name | | Include related | ?include=orders |

When to Use

• Designing new API endpoints
• Choosing HTTP methods and status codes
• Implementing caching headers
• Setting up rate limiting
• Structuring error responses

Additional Resources

For detailed patterns, load:

• ./references/status-codes.md - Complete status code reference with examples
• ./references/caching-patterns.md - Cache-Control, ETag, CDN patterns
• ./references/rate-limiting.md - Rate limiting strategies and headers
• ./references/response-formats.md - Errors, versioning, bulk ops, HATEOAS