Question

Let’s say I have a resource called “Session”. The client would call PUT to create and begin a new session. When the client is finished with the session, it should no longer be accessible, but should persist for historical/accountability reasons.

To end the session, would it be more appropriate to issue a DELETE request, which would seem semantically closer to the desired effect, or POST, seeing as the resource isn’t actually removed permanently?

Answer 1

The question here is: Is the request idempotent? If you execute the same request twice, does it have a side effect? Like when you order an article, executing the order request twice would get you the article twice.

In that case, POST is the method you want. If not, then you want either PUT or DELETE.

As you don’t seem to be deleting the session, only altering its state, PUT would be a better method, because it means that the resource is altered, and not deleted, which is the case in your case.

Edit:

If the resource appears to be deleted from the client, DELETE seems more appropriate. How things are implemented in the back doesn’t matter for the client.