Status code when using PUT endpoint to create resource in REST api

0
votes

When you use PUT endpoint to create resource in REST api, what should the endpoint return for subsequent calls after returning 201(created) for the first call? 403(cannot create since the resource already exist)? 200(updated to the same exact object?) if you change the status code after one call(201-> 200 or 403), isn't that a violation of idempotency? I looked everywhere but all I can find is you can use PUT to create but nowhere it said about status code change after resource creation. In short my question is that PUT is an idempotent method, but when it is used in resource creation, can it still change it's return status code from the following calls?

p.s. After first calls, it will be idempotent(constantly 403 or 200). And ideally I want to be able to tell the client that the resource is already created and you shouldn't call this again.(403) I know using POST is an alternative but as ID is already known to client at the point of creation I wanna use PUT method but want to know the proper REST way in terms of idempotency.

=================================================================== References of Using PUT endpoints for creating resources http://restcookbook.com/HTTP%20Methods/put-vs-post/ https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

The fundamental difference between the POST and PUT requests is reflected in the different meaning of the Request-URI. The URI in a POST request identifies the resource that will handle the enclosed entity. That resource might be a data-accepting process, a gateway to some other protocol, or a separate entity that accepts annotations. In contrast, the URI in a PUT request identifies the entity enclosed with the request -- the user agent knows what URI is intended 9.6. PUT If a new resource is created, the origin server MUST inform the user agent via the 201 (Created) response. If an existing resource is modified, either the 200 (OK) or 204 (No Content) response codes SHOULD be sent to indicate successful completion of the request.

http://zalando.github.io/restful-api-guidelines/http/Http.html

PUT requests are usually robust against non-existence of resources by implicitly creating before updating

successful PUT requests will usually generate 200 or 204 (if the resource was updated - with or without actual content returned), and 201 (if the resource was created)

1
restapiputhttp-status-codeshttp-method
Do you mean a POST or a PUT, it is regulate to use a POST to create an object, and a PUT to change an object – lordkain
@lordkain, Not necessarily, you can use PUT to create, and sometimes it's better to use PUT – Clojurevangelist
thanks learned something new today, an other perspective – lordkain

1 Answers

1
votes

Idempotency is about the server state - not about the responses. E.g. DELETE is idempotent, but after the 2nd try the resource will not be found and you may choose to respond with 404. But the state of the server is going to be the same - the resource is deleted.

Same with PUT - you can invoke it multiple times, but the state of the server will always be the same after the operation is finished.

Ideally though you could reuse PUT for updating the resources. So when the 2nd request is arrived you can use that for updating instead of returning errors. That will probably simplify implementation and the contract.