How do I create a REST API for a web service whose RPC method has overloaded values?
Existing XML Web Service
-
handles XML-RPC style requests in which an operation element identifies a dispatch method. For instance:
<protocol> <operation> 810 </operation> <user> ... </user> </protocol>
-
The number of parameters changes.
- The XML-RPC processor interprets token 810 to mean two things. If it receives the <user> element as a child of the <protocol> element , it CREATES an account. If it receives a <userExisting> element , it will try to log in to the user.
New JSON REST API Design
- I want to store this in one REST endpoint for example. / API / Foobar
- I can translate user creation to PUT / api / foobar / $ {user}
- Delete user on DELETE / api / foobar / $ {user}
- My current project is to make POST / api / foobar / $ {user} body {"op": "login"} for login and similarly for logout, body {"op": "logout"} will be submitted.
What do you think about this? Bricks and bouquets are welcome with constructive comments.
a source to share
Overloaded POST for RESTful APIs is a bit of a trick if you can avoid it. For login purposes, I would rather try to keep it stateless - this would mean that the client has to send HTTP authorization on every request (which means that the correct authorization header has to be sent every time). On the first request, you use one of the common authentication methods, such as Basic.
a source to share
The endpoint must be in the URI api/users
for all CRUD operations. DELETE and PUT are not supported on forms built with HTML 4, but if you are using Javascript to communicate then you should be fine, but you can also open create and delete operations via POST (perhaps by passing _method=PUT|DELETE
in a POST payload).
There should be an endpoint to login api/login
, but you're better off using HTTP Authentication here.
Asking for design reviews on Stack Overflow is fine, but you'd be better off reading on RESTful architectures to avoid twists and turns.
a source to share
How about something like this for login and logout
POST /api/foobar/${user}/loginrequests
POST /api/foobar/${user}/logoutrequests
The server doesn't really need to create a "request" resource if you don't want to, but later you can change your mind and want to keep a record of the ins and outs.
a source to share