Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is it OK return http status 404 in the POST?

Tags:

rest

http

post

I'm developing an API and I always try to use the most correct http status codes for each scenario.

One of this scenarios is the response for POST requests. Per example, a POST method for an endpoint /orders/ receive some informations, like a customer:

{
  customerDocument: {number: "123.456.789"},
  // other informations for create a order
}

So, my questions is: if this number from customerDocument not exists, is it Ok to return a 404 status code error with a nice message telling that the customer was not found?

I normally use 404 only for GET in the specific resources (the most obvious usage), like:

/customers/{number}/

In business validations like "The customer is not active", I normally use the http status code 422 for any http method (POST, PUT, GET, etc). I'm in doubt if I can use 404 or 422 for my POST example.

like image 213
Dherik Avatar asked Jul 04 '17 23:07

Dherik


People also ask

What is the HTTP response code for 404?

Overview. When communicating via HTTP, a server is required to respond to a request, such as a web browser request for a web page, with a numeric response code and an optional, mandatory, or disallowed (based upon the status code) message. In code 404, the first digit indicates a client error, such as a mistyped Uniform Resource Locator (URL).

What is the 404 (not found) status code?

The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists. I just realized that’s the fourth post in this series and 404 Not Found has been involved in all posts so far.

Can We disclose information by returning the HTTP status code?

But it was obvious that in certain circumstances we can inadvertently disclose information that a malicious user could use to their advantage just by returning the real HTTP status code. One of those situations is when the resource is forbidden (403).

Why is the response status code for /orders/ endpoint 404?

From RESTful API point of view, endpoint /orders/ is a resource, no matter it accepts GET or POST or something else. 404 is only appropriate when the resource /orders/ itself does not exist. If /orders/ endpoint exist, but its invocation failed (no matter what reasons), the response status code must be something other than 404.


Video Answer


1 Answers

I think 400 is the appropriate status code in this scenario, given its definition from Wikipedia:

400 Bad Request

The server cannot or will not process the request due to an apparent client error.

According to the description, semantically, 422 is better ("The request was well-formed but was unable to be followed due to semantic errors."). However, 422 is introduced for WebDAV, so it is better to use general purpose status code such as 400.

400 is not the perfect status code, as whether document number exists or valid is not so apparent. However, excludes special-purpose status code such as 422, 400 is the best option.

Why 404 is not appropriate?

From RESTful API point of view, endpoint /orders/ is a resource, no matter it accepts GET or POST or something else. 404 is only appropriate when the resource /orders/ itself does not exist. If /orders/ endpoint exist, but its invocation failed (no matter what reasons), the response status code must be something other than 404.

like image 117
shaochuancs Avatar answered Sep 19 '22 04:09

shaochuancs