403 sounds like the most appropriate choice. It basically says “nu-uh. You don’t get to see that.”, which is pretty much the case here. 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. […] Of course, it’d be a … Read more
This is a matter of opinion, which is not the kind of Question that Stackoverflow loves to see. in any case, I will offer mine. You are returning the representation of the state of an object or resource. The ID is part of that representation, and therefore ought to be included in the JSON packet. … Read more
Normally this should be handled through content negotiation. In other words, the client asks for a specific representation if it needs one. The request would look like this: PATCH /user/123 Content-Type: application/merge-patch+json Accept: application/vnd.company.user+json … In this case, the client expresses that it wants a full user representation as answer. Or it could do: PATCH … Read more
My research results: Single request (data included) The request contains metadata. The data is a property of metadata and encoded (for example: Base64). Pros: transactional everytime valid (no missing metadata or data) Cons: encoding makes the request very large Examples: Twitter GitHub Imgur Single request (multipart) The request contains one or more parts with metadata … Read more
@JohnDoDo One first question: Does the media type define the contract between my server and client? Yes, media type is one part of the contract. Contract in REST API is not static unlike SOAP(i.e. WSDL). Contract is defined by combination of underlying protocol(i.e. HTTP), URIs and Media Types(it’s not prohibited to use several media types … Read more
Since REST is the application of the same methods of the HTTP protocol to the design of client-server architectures and PHP is already so good to handle HTTP protocol requests such as GET and POST. PHP is specially suited to make developing REST services easy. Remember REST is the application of the same http patterns … Read more
You’re defining a handler for actions that map to REST over http. POST and GET generally refer to update and query over an entity. There’s absolutely no reason you can’t just define a handler for generic versions of these CRUD operations that can be used in both contexts. The way I generally do this is … Read more