I’ve made a restful web service with two resources named project and device. It is designed to use URIs like “/project/{projectId}/device/{deviceId}” to access a specific device in a project. However, it is meaningless if the device does not belong to the project. What status code should the system return if the projectId and deviceId do not match?
-
HTTP 400 Bad Request: Not likely, since the syntax of request is correct.
-
HTTP 403 Forbidden: Most likely, but I would like to return 403 when the project or the device is disabled.
-
HTTP 404 Not Found: Both projectId and deviceId exists. They are just not matched.
404 Not Found
This indicates that the URL, as a whole, does not correspond to any resource.
From RFC 2616 sec 10.4.5:
However, you are always free to provide additional information in the body and headers. For example, you could put links in the body to the relevant project URI and relevant device URI, with the explanation that the device is not related to the project.
The "400 Bad Request" status should only be used for requests with syntax errors. From RFC 2616 sec 10.4.1
The "403 Forbidden" semantics are a bit fuzzy.