API Design: Separate or combine internal with external functions?

Question

For a simple example, let's say you create guestbook in your site and you plan to give external access for Create and Read functions via API. Update and Delete will not be included in the API since it should only be used internally.

What's a better practice?

• Make the whole CRUD functions available via API and just restrict public access to Update and Delete. So you yourself will also use the API for all internal workings of the app.

• Make internal CRUD functions without API for all internal workings, then create a separate API for Create and Read only. Basically this give you two ways to use Create and Read - one with API, one without.

• Make internal Update and Delete functions without API for internal workings, then create API for Create and Read only. If you need to use Create and Read functions for internal workings, then you must use API.

I hope it's quite clear, what's generally the best practice?

Answer 1

I like the first option. It has a clear example of separation of concerns and using right tools in the right context.

By using CRUD approach for the API, you gain uniformity and integrity. It results in a more cohesive design, less code duplication and easier evolution down the road. The security aspect could be implemented either inside or outside of the application powering the API. For the outside option you could use 3-d party software or hardware solutions like firewalls, for example.