All resources
APIsBeginner1 min read

REST API Design Basics

Methods and idempotency, status codes, consistent errors and cursor pagination — conventions clients can rely on.

Resources and methods

Name endpoints after resources (plural nouns) and let the HTTP method express the action. Idempotent methods can be retried safely after a timeout.

MethodExamplePurposeIdempotent
GET/users/42Read a resourceYes
POST/usersCreate a resourceNo
PUT/users/42Replace a resourceYes
PATCH/users/42Update some fieldsNot guaranteed
DELETE/users/42Remove a resourceYes

Status codes that carry meaning

CodeWhen to return it
200 OKSuccessful read or update with a body
201 CreatedResource created; include a Location header
204 No ContentSuccess without a body (e.g. DELETE)
400 Bad RequestMalformed request or invalid JSON
401 UnauthorizedMissing or invalid credentials
403 ForbiddenAuthenticated but not allowed
404 Not FoundResource does not exist (or is hidden)
409 ConflictState conflict, e.g. duplicate email
422 Unprocessable ContentValid JSON that fails validation
429 Too Many RequestsRate limited; include Retry-After

One error format everywhere

Use the same shape for every error so clients can handle them generically. RFC 9457 (Problem Details) is a widely supported standard.

422 responseJSON
{  "type": "https://api.example.com/problems/validation",  "title": "Validation failed",  "status": 422,  "errors": [    { "field": "email", "message": "Must be a valid email address" }  ]}

Cursor pagination

Offset pagination (?page=3) skips or repeats items when rows are inserted. A cursor points at the last item seen, so pages stay stable and queries stay fast on large tables.

GET /v1/orders?limit=2&cursor=b3JkXzEwJSON
{  "data": [    { "id": "ord_11", "total": 4900 },    { "id": "ord_12", "total": 1200 }  ],  "nextCursor": "b3JkXzEy",  "hasMore": true}