REST API Design – Is It RESTful to Have Verbs in the HTTP Path?

api-designdesign-patternsrest

I've encountered API that tell as being "restful" but then I see resources with verbs instead of reserving those said verbs to the METHOD.
Here's some (paths shortened so only the relevant method and path parts are shown):

  1. POST /things/84/lock
  2. POST /things/84/unlock
  3. POST /things/84/edit
  4. POST /things/prepend (Adding to the beginning of the ordered collection)

Why doesn't it make sense to do instead:

  1. LOCK /things/84
  2. UNLOCK /things/84
  3. PATCH /things/84 or EDIT /things/84 (I prefer the first one)
  4. PREFIX /things or PREPEND /things

I've only been told again and again that this is not restful because it must only use GET, POST, PUT, DELETE and PATCH to remain restful.

What logical explanation exists for having verbs in the path section of the URL for restful API?

Notes:

  1. I can't show you real life examples so I won't be pointing fingers
    at anybody.
  2. As for proxy limitations excuse I've been experiencing. It was valid while no workaround existed. Nowadays, most modern frameworks have mechanisms to allow method override using query variables or headers (with de-facto standards, even).

Best Answer

Is it restful to have verbs on the HTTP path instead of the HTTP method?

Yes. REST doesn't care what spelling you use for your identifiers.

I've only been told again and again that this is not restful because it must only use GET, POST, PUT, DELETE and PATCH to remain restful.

One of the REST architecture constraints is the uniform interface; describing it in his thesis, Fielding wrote

By applying the software engineering principle of generality to the component interface, the overall system architecture is simplified and the visibility of interactions is improved. Implementations are decoupled from the services they provide, which encourages independent evolvability....

There's nothing particularly magic about [GET, POST, PUT, DELETE, PATCH]. A very long time ago, that list would probably be [GET, HEAD, POST], because those were the only methods that had been standardized in RFC 1945. The others were documented with this warning:

This appendix documents protocol elements used by some existing HTTP implementations, but not consistently and correctly across most HTTP/1.0 applications. Implementors should be aware of these features, but cannot rely upon their presence in, or interoperability with, other HTTP/1.0 applications.

The interoperability is key, in that it means that clients and servers and intermediary components that share an understanding of the message semantics can all cooperate together to produce a result -- without needing to understand the payload of the message.

Today, we have a method registry, with many different methods that you might want to use, including (as it happens) LOCK and UNLOCK. So, assuming your semantics agrees with those documented in the registry, you could use them.

In circumstances where you control both the client and the server, limiting yourself to the registered methods is less critical than it would be otherwise.

If you are targeting clients that understand code on demand, then you can give a generic client a link to download your client code to interact with your services.