Question

Just wanted to get feedback on how I am planning to architect my API. Dummy methods below. Here’s the structure:

GET http://api.domain.com/1/users/ <-- returns a list of users
POST http://api.domain.com/1/users/add.xml <-- adds user
POST http://api.domain.com/1/users/update.xml <-- updates user
DELETE (or POST?) http://api.domain.com/1/users/delete.xml <-- deletes user

Questions:

1. Is it OK to use just GET and POST?
2. Is it a good idea that I plan to rely on the filename to indicate what operation to do (e.g. add.xml to add)? Would it be better to do something like this: POST http://api.domain.com/1/users/add/data.xml?
3. What’s a good way to keep these resources versioned? In my example, I use a /1/ after domain name to indicate version 1. Alternatives would be: http://api1.domain.com… or http://api-1.domain.com… or http://apiv1.domain.com… or http://api-v1.domain.com… or http://api.domain.com/v1/… or
4. What’s the best way to authenticate?

Answer 1

1) On your design probably not. POST is not idempotent! So you should not use for the update or the delete, instead use PUT and DELETE from Rest

2) A better choice is to use the header Content-Type on the WS call, like: application/xml

3) Also on the header Content-Type u can use it: application-v1.0/xml

4) Not sure if it is the best, but probably the easiest way is to use HTTP’s built-in authentication mechanisms in RFC 2617. An example: AWS Authentication