RESTful reset password and confirm email

Question

im thinking what is the best RESTful way how confirm email and request reseting password. Im only aiming to find correct URI...

confirm email

PUT /users/{userId}/confirmEmail?code=xyz - does not seem much RESTful because of confirmEmail

PUT /users/{userId}/email?confirmedBy=xyz - maybe better? dunno

reset password (similar problem)

PUT /users/{userId}/resetPassword --DATA {email:[email protected]} - same thinkin as before

PUT /users/{userId}/password --DATA {state:reseted,resent:[email protected]} - hmmm... again Im not sure

are there any better ways in your mind?:-)

Answer 1

If you want your URIs to refer to resources, then call the resource confirmation and POST confirmations to user accounts.

POST /users/{userid}/confirmation

Answer 2

The true RESTful answer is the URL does not matter, you put it in the confirmation e-mail anyway for the recipient to follow. Use whatever is most convenient for your load balancer, reverse proxy, servers, etc.

For convenience you'll end up accepting the confirmation even if it comes in a GET request, because that's what the browsers of flesh-and-bones humans oblivious to Dr Roy T. Fielding et al. send when clicking on a link in an e-mail :-)

Having established it is completely academic, I'd argue you were right to think of PUT, as the client idempotently places evidence of having access to the e-mail. Repeating the request has no further effect.