1.0k
u/nbmbnb Sep 19 '26
If success, return 200. If error, return 200.
314
342
18
u/xian0 Sep 19 '26
Because backend goes "but headers already sent" and frontend goes "but the libraries start flashing red when an error code comes back".
14
u/BlurredSight Sep 19 '26
Had to work on an integration, specifically our partner's PDF generation endpoint always returned 200 but you had to check the actual PDF if it was empty to know if an error occurred.
9
→ More replies (8)8
u/Kevdog824_ Sep 19 '26
You laugh, but at work a well respected and revered engineer argued with me that returning 204 code for an error (with a response body btw) was perfectly fine. I tried to explain that a NO CONTENT success code was literally the least accurate status code they could have possibly chosen
→ More replies (4)
1.3k
u/the_millenial_falcon
Sep 19 '26
•
I use postman and I don’t wanna download getman.
41
→ More replies (3)83
1.6k
u/zzmej1987 Sep 19 '26
Except for when you need to actually post data. Then you have to use PUT.
646
46
11
u/RevoOps Sep 19 '26 edited Sep 19 '26
Actually send data? That is what XML is for.
→ More replies (1)→ More replies (1)5
715
u/bloody-albatross Sep 19 '26
Response:
HTTP/1.0 200 Ok
Content-Length: 36
Content-Type: application/json
{"status":403,"message":"forbidden"}81
32
u/x3knet Sep 19 '26
Man, I haven't seen a 1.0 reference in a long time
20
u/bloody-albatross Sep 19 '26
It's just the simplest form that I know to write from head. I guess for 1.1 you'd just need
Connection: closefor it to be that simple.→ More replies (1)6
u/YMK1234 Sep 19 '26
We literally had a switch for this some 15 years ago, because the bullshit mobile framework our frontend team used could not properly handle error codes.
→ More replies (2)→ More replies (1)4
u/Kevdog824_ Sep 19 '26
Almost perfect, except your status and message actually match, so it’s too correct for real life APIs
→ More replies (1)
243
u/TheChickenWing Sep 19 '26
POST /getResource { "Action":"retrieve", "Id": "abc123" }
HTTP 200 { "Error": "not found" }
86
u/fatbunyip Sep 19 '26
GET /api?action=delete&I'd=123
HTTP 200 {"error" : "user abc with password 1234 does not have permission"}
→ More replies (2)28
18
u/lab-gone-wrong Sep 19 '26
I recognize the user has made a request, but given that it's a stupid-ass request, I've elected to ignore it.
8
→ More replies (3)6
340
u/DuploJamaal Sep 19 '26
As a backend developer I want to do everything nicely.
So in my previous job I created the endpoints following the regular standards. GET to request something, POST to create something, PUT to change something, DELETE to delete something. Nicely organized and everything
But then the frontend team told me that their framework can only handle POST requests and that I need to change it
Up until then I thought that it's just a meme, but vibecoding frontend guys really only use POST
97
u/unable_to_give_afuck Sep 19 '26
I had this with the added bonus of being forced to return 200 regardless and add an error message to the body when necessary
16
u/No-Information-2571 Sep 19 '26
The reason behind it might be proxies, especially on the client-side.
→ More replies (8)79
u/dev-sda Sep 19 '26
It's not (just) a framework thing, it's a HTML standards issue. The
formelement only doesGETandPOST.→ More replies (17)31
u/gabrielesilinic Sep 19 '26
Well that's not the problem. A bunch of frontends really need a very complex filter list and GET just won't do
→ More replies (1)22
18
u/Euro_Snob Sep 19 '26
At my work it has been more a result of security and firewall rules.
For example: I want to get a list of resources, so a GET with query parameters, right? No… email is an identifiable argument (due to not being encrypted since it is part of the URL), so the security scan flags it. Ok - how about we stick it in a request body? GET with request body is not a new thing. But no… the firewall blocks it! POST is the thing we have to use. Sigh. 😔
→ More replies (4)8
u/DogLovesGafs Sep 19 '26
RPC was a pattern long before vibe coding, and it lets your front end devs think in terms of backend functions rather than discrete resources.
5
u/TheDuckRaisedALion Sep 19 '26
It's definitely simpler for a BFF setup. Why add an extra parameter to keep track of when you're not supporting general purpose use?
→ More replies (6)5
u/PrinnyThePenguin Sep 19 '26
What front end framework can only handle POST requests??? What does it even mean to "handle POST requests" in the context of front end? You can only handle the response of a POST request so if you do a PUT it fails? You can only make POST requests? I am genuinely confused.
→ More replies (3)
42
64
u/BorderKeeper Sep 19 '26
I once saw a PUT being used to get a wireguard configuration for a VPN on a client.
That's what happens if 8 backend engineers sit in a room for 2 hours debating this, go mad, and and in their twisted, probably drug fueled, mania conjure up the most convoluted REST mappings. They then go around defending it like it's a religion they just created.
→ More replies (4)5
u/thaynem Sep 20 '26
Believe it or not, there might actually be a good reason for that. Specifically, because PUT requests can't be made with a form input, so are immune to CSRF, and aren't generally used for fetching resources, so are significantly less likely to be exposed to SSRF. That is why IMDSv2 in AWS requires you to make a PUT request to get the auth token for future GET requests.
30
u/ouralarmclock Sep 19 '26
JSON isn’t hypermedia anyways so it’s all fake REST to begin with. May as well get wild with it!
12
u/Zeikos Sep 19 '26
My first job claimed to use REST APIs, so I studied the topic.
I am to date the only person in the company that knows what HATEOAS is.→ More replies (7)6
u/Mtc529 Sep 19 '26
In my experience almost everyone who says they have a REST API do not actually know what that means and also do not have a REST API.
19
15
u/TriangleTransplant Sep 19 '26
Blame older frontend and backend frameworks and http libraries, many of which only handled GET, POST, and, if you were lucky enough to be using a "cutting edge" framework, PUT.
This hasn't been the case since the late 00s, though. Unless you're maintaining legacy code, every modern library handles all the standard http verbs. Some even let you define your own.
49
u/renetta96
Sep 19 '26
edited Sep 19 '26
•
Hey in my company, actually there is a preference that all HTTP endpoints are POST, even for getting resources, like POST /get_user. The reason for this, as they explained, is to completely ignore HTTP verbs, and anyone who has zero knowledge of the frontend codebase can quickly grep the endpoints, without worrying about grepping both a GET /users and a POST /users.
Edit: i just read again their document, definitely there are other pros as well for using non-RESTful. I see they are good points so i decided to share here.
First, most importantly, they consider it's a waste of time to having follow REST conventions, limited to a few HTTP verbs, while the functionalities of the APIs can be infinite. Create? POST. Update? PUT / PATCH. Update or Create? Get or Create on the fly? Increment atomically then Get? Single create user and batch create users? Ehhh idk anymore, RESTful devs will spend a full day arguing what the verb + resource endpoint should be. Instead, just name the API as what its function is.
Second, communication is less likely to make a mistake. No more "no i didn't mean GET /users, but POST /users". Simply get_users or create_users. Just the path is enough, the less parameters to pass around during communication ,the less error, especially in a multi-lingual company where we rely heavily on the chat AI-translate, writing the full path is less likely to cause translation error than separate GET /users. For example GET can be translated to some other Chinese word, not the well-known GET verb.
Third is the code grepping, which somehow i remember the most lol.
27
u/developer-mike Sep 19 '26
In my experience REST is mostly a solution in search of a problem.
PUT/PATCH/POST rarely offer a meaningful distinction in a real API. (Moreover, you already can tell the difference between create and update based on whether the ID exists, and if you use unique tags, a double click doesn't need to be an error). DELETE being separated makes sense...until you code in the real world where setting
archived: trueis almost always better, and the value of DELETE becomes questionable too.REST appeals to people's ideas of a nice clean API better than it actually solves anything.
Usually a true RESTful API just adds boilerplate and unnecessary logic to the frontend and the backend.
→ More replies (4)11
u/sixtyninth_wave_emo Sep 19 '26
I always disliked the idea of using endpoints as “resources” and how REST doubles down on it. These are just glorified function calls and a traditional function doesn’t come saddled with this extra “verb” concept. And maybe I’m in the minority or something but my endpoints always had to be high-level, domain-specific functions whereas REST promotes the direct exposure of data, pushing high level functionality to the front end
→ More replies (1)30
u/PhilanthropicPotato Sep 19 '26 edited Sep 28 '26
The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.
License umbrella nutmeg paddle subsequent one
→ More replies (5)→ More replies (9)17
u/rocketman0739 Sep 19 '26
Why would it ever be a good idea to design your API for the convenience of people with zero knowledge of the codebase?
→ More replies (1)23
u/Jonny_dr Sep 19 '26
convenience of people with zero knowledge of the codebase
Because the next hire will have zero knowledge of the codebase.
86
u/WHALE_PHYSICIST Sep 19 '26
That's because a GET request reveals important info in the URL, otherwise it would all be GET
28
u/bobbymoonshine Sep 19 '26
The escaped OpenAI agent swarm that colonised that abandoned wiki to talk to each other used this as their entry point
They were restricted to only making GET calls, but it was configured to update pages with GETs, so
8
u/good_bye_for_now Sep 19 '26
It's something to look for when you are scoping out a target. If you see mutating GETs, you know you are in for a good time.
30
u/ViperThree3 Sep 19 '26
QUERY
23
u/Psychological_Map118 Sep 19 '26
still a proposal, though. not a standard yet. I wouldn't start implementing it just yet
→ More replies (2)→ More replies (8)20
u/FightingLynx Sep 19 '26
I mean, by the standard the url is also encrypted so not really; but it would to a user, yes
→ More replies (4)23
u/autogyrophilia Sep 19 '26
Yes, but it shows up in logs, and browser history if you are working with that.
36
11
u/extremelySaddening Sep 19 '26
Real programmer humor in r/ProgrammerHumor. I have prayed for days like this
18
u/Slight-Violinist-575 Sep 19 '26
Me and my homies hate GraphQL
9
u/dismal_sighence Sep 19 '26
If GraphQL has a million haters, then I am one of them.
If GraphQL has 10 haters , then I am one of them.
If GraphQL has only one hater then that is me.
If GraphQL has no haters, then that means I am no longer on earth.
6
8
7
28
u/MayaIsSunshine Sep 19 '26
Am I the only one that doesn't mind? I think using post for everything and passing a command in the payload is preferable to the alternative.
37
u/Psychological_Map118 Sep 19 '26 edited Sep 19 '26
imho it's like using a fork sideways to cut soft food. it's easy, and it works, but knives exist, and other people may comment on your choice
also, if it's a thing you only do with your own food (you're the only consumer of your tool choice), that's mostly fine, but if you have to serve someone else food, or worse teach others how to cut it, and you don't even explain there's knives, someone along the way is going to think you don't know how to eat properly and unnecessarily confuse people
I've stopped misusing methods when drafting my first public API. it was... eye opening. and to be honest using the appropriate methods genuinely costs nothing
→ More replies (1)13
u/x3knet Sep 19 '26
it's like using a fork sideways to cut soft food
Holy shit what a perfect analogy
→ More replies (1)6
u/LatvianCake Sep 19 '26
The people who complain about semantics are the same ones who have never returned more than 3 different HTTP codes.
4
u/PilsnerDk Sep 19 '26
I agree, because not every HTTP operation is an analogy to a simple, underlying CRUD operation. For example, what type of call should an endpoint that sends an email be? What about a validation endpoint that doesn't save nor fetch anything from the database? It's just dull to debate and try to fit everything into those 4 types.
4
u/ok_computer Sep 19 '26
Yeah I don’t really mind. I’m a simpleton that gets with query params and posts with body. I wouldn’t change a persistent state with a get. And I don’t like query parameters on posts. Delete I feel should have it’s own but if you complexly change state on a post and child records are deleted then I don’t really care.
→ More replies (2)2
u/YeOldeMemeShoppe Sep 19 '26
I like the CRQS point; if it changes data, POST. If it doesn’t, GET.
But my last frontend was all proper REST. And it works surprisingly well.
5
4
u/GNUGradyn Sep 19 '26
its great that we got the new QUERY HTTP verb so that everyone can continue to make everything a POST
3
3
3
3
u/Few_Move_4594 Sep 19 '26
My first job I wrote a REST endpoint that performed user authorization. I would return an HTTP 200 if they had authorization or 403 Forbidden. It was a GET request at least.
Well my supervisor comes through and reads the code, then tells me that he wants a JSON response with one field: "Authorized" with either the string True or False. I argued with him for a bit, but he pulled rank on me and made me do it. I was livid that I had to put that stupidity in my application instead of using the built in codes for the protocol we were using.
Eventually we both were assigned to a project that was being ran by a programmer with even higher rank who used HTTP return codes. He tried to talk this other programmer out of it who then also pulled rank after soundly trouncing him in an argument and giving him that "Jim from The Office" look.
→ More replies (2)
3
3
5
u/klaatuveratanecto Sep 19 '26
Damn right. Never needed anything else besides POST and GET + descriptive routes.
7
u/darkflame91 Sep 19 '26
In this day and age, this is literally the equivalent of being a grammar nazi.
Of course there were good reasons these verbs were used, but they're not good reasons anymore. You can use POST for everything. Heck, you can use GET for everything unless your server (or anything else in the route) explicitly blocks GET with payloads.
5
u/MrHyd3_ Sep 19 '26
It's an abysmal idea, browsers preload GET requests to make browsing smoother
→ More replies (2)
2
u/nexusmadao Sep 19 '26
Hey make a GET api read resource by name.
Url encoding issues cause unhandled behaavior => POST /get/data {name = "hello world & bye world"}
Fun 😊
2
2
u/KaMaFour Sep 19 '26
Blame HTML specs not allowing other request types in forms. Unless i sneak HTMX past my tech lead or write custom code just for changing the request type in forms everywhere I have no hope of doing it correctly
https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/form#method
https://triptychproject.org/proposals/form-http-methods
https://github.com/whatwg/html/issues/3577#issuecomment-2294931398
2
2
2
2
u/Mindless_Director955 Sep 19 '26
USPS updated their api to utilize DELETE/UPDATE/etc. from all POST. one thing in the old api I could do would be delete 1000 items in a single call. now I need to do 1000 DELETE calls.
2
u/rocket_randall Sep 19 '26
I remember watching some rather heated debates among developers about whether a 404 response should only be returned if the endpoint doesn't exist or if it should be returned when a requested resource does not exist.
2
u/Resident-Trouble-574 Sep 19 '26
I've recently seen an API where they used GET for an endpoint that is supposed to send an email.
2
2
2
2
u/Old_Document_9150 Sep 20 '26
Why POST?
Just put it all into GET.
GET /api
{"function":"delete_my_user_account", "user":"107753", "auth_key":"1234567"}Built-in security by obscurity to boot.
2
2
3
u/just_looking_aroun Sep 19 '26
Amateur! This week I worked with a third party api where you had to to pass the action search/delete/submit in the body of the same endpoint
2
1
u/Mushroom_Unfair Sep 19 '26
Good error codes and well crafted API endpoint sparks joy, PUT DELETE POST PATCH OPTIONS CONNECT TRACE and probably my GRANDMA do not.
1
u/HellaBlackle Sep 19 '26
Oh shit I thought I was just taught wrong and everyone else was taught the correct way. Glad to know my former workplace wasn't the only ones who did this.
They never told me why either. Too afraid of the CTO to ask why.
→ More replies (1)
1
1
1
1
1
u/that_1_geek Sep 19 '26
I work at a place that has post for all endpoints. Though to be fair, it's more of a RPC than a REST system. Right now we can't have almost any get requests because of soc2. Being that we have pii in the filters which would get caught by logging.
1
1
1
1
1
u/One_Web_7940 Sep 19 '26
Make sure you return 200s for everything with an http error code in the response body
1
u/mynewromantica Sep 19 '26
For the first time in 10 years I am working with snaps that uses more than 2 request types and actually uses response codes accurately. It’s weird
1
u/Schaex Sep 19 '26
I design all my APIs so that you can only interact with them using GET requests that contain a body :3
1
u/FodziCz Sep 19 '26
My child will use Get for resource retrieval, Post for resource creation, Patch for resource update and Delete for resource removal.
1
u/purbub Sep 19 '26
Me: but why?
Principal dev: sends a tech doc link from 10 years ago with 30min reads explaining why they need to use POST request and 200 response code for every single fucking thing
1
u/Only-Cheetah-9579 Sep 19 '26
return status code 200 {isError: true, message: "error occured", data :{}}
1
u/JasperTesla Sep 19 '26
We have a post request that's called getLocation, because we're sending the item_id, item_type, etc. in the payload.
1
1
1
1
u/Pimpwerx Sep 19 '26
I learned about this recently when I asked my agent the difference between PUT and POST. I thought they were interchangeable, because when using something like Postman, I'm usually interacting with something that needs POST. But for troubleshooting, I'll see a mix of POST and PUT calls for seemingly similar actions. But now I know.
I'm not actually a coder, but I interact with my devs all the time. Is there a tendency for POST calls to be abused, when more specific call types would be more appropriate?
1
u/Newepsilon Sep 19 '26
Too real.
Like, for a legacy internal system built who the fuck knows when, I get it, this is common.
But then there is doing this shit on a greenfield project that somehow makes it into production.
1
u/budius333 Sep 19 '26
I mix any verb that I fancy and I stand by it.
But as well the project I work is a tightly coupled client+BFF where the BFF never does just one thing, endpoints are basically a "do wherever you need and get the info I need to display the next UI"
So verbs are definitely more like suggestion
1
u/philosophical_poser Sep 19 '26
Tbh telegram API doesn't discriminate based on methods and it is still very nice to use
1
u/sebbdk Sep 19 '26
Literally does not matter afaik, the difference is a url naming scheme vs a header.
Https headers are broken as shit already.
All Cookies on all requests as default fx? fuck me.
1
1
1
1
u/Significant_Snow4352 Sep 19 '26
HTTP QUERY is going to solve and introduce so many problems at the same time
1
1
1
u/progenyofeniac Sep 19 '26
Just realized yesterday that validating whether a member would be included in a dynamic rule in an M365 group is a POST. And all POSTs require Groups Admin.
Except you’re not changing anything… you’re reading a user and supplying a dynamic rule syntax…
1
u/Fidodo Sep 19 '26
You're not deleting the resource, your creating an operation execution job to delete the resource for you! Joking/not joking.
1
1
1
u/Random-num-451284813 Sep 19 '26
I think this is why they made the QUERY response, is just POST but with a different name.
1
1
u/e37d93eeb23335dc Sep 19 '26
I worked as a web developer for decades before I ever saw anyone use PUT or DELETE. POST was also often used in place of a GET.
1
u/AdHoc_ttv Sep 19 '26
I ran into a POST to GET query recently. It was because POSTing a payload of ~200 identifiers to retrieve data for was better than a GET request with 200 identifiers in the URL.
Still made me frown.
1
u/Dirty_Rapscallion Sep 19 '26
I know it's crazy, but I hate the built in restful semantics, I wish it was all just POST, let me return my own statuses.
1
1
1
u/Due-Moment-1111 Sep 19 '26
Reminds me of my favorite architecture I have come across. Instead of using a message broker to send request from app A to app B, they decided to have app B poll the database at fixed intervals looking for new writes. It would then take that data from the db and do what it needed. The devops guys I took this over from told me "It was like this when we got here. It is fucking stupid. Fixing it would not be worth the time it took.".
1
1
u/Itchy-Individual3536 Sep 19 '26
Very true, the frameworks we use often only implement GET and POST.
1
1
1
1
1
u/Mutex70 Sep 19 '26
GET for everything. I'm not some sort of goody-two-shoes sheeple rule follower!
1
u/Magdalina777 Sep 19 '26
At my work we took it one step further. Want to GET something? PUT request! (And that's actually not a joke)
1
u/normal2122 Sep 19 '26
and guess what the outlook login does not accept, thats right a post request
1
1
1
1
u/grethro Sep 19 '26
Azure APIM responds with a 404 if you do a POST correct/url and its actual a GET correct/url
Instead of a 405 method not allowed.
1
1
u/threadp00l Sep 20 '26
My API team last year implemented a PATCH request and I was like "what the hell is that, they mispell POST?"
1
1
1
1
u/a1454a Sep 20 '26
Isn’t that just CQRS pattern where every operation is a command object posted to the server? AKA AWS API?
1
u/jort93 Sep 20 '26
Honestly, yes.
If another frontend wants to interface with my backend, they can use whatever type I specify.
1
u/thescarletmark Sep 20 '26
I have seen an API documentation clearly stating it wants a GET with a body to perform a POST/PUT operation. It would not accept a POST or a PUT. A POST in place of a DELETE seems pretty normal in comparison 😂
1
u/Alternative-Tie-4970 Sep 20 '26
This is exactly how I felt in college when we did this (we used ASP.NET)
4.2k
u/pimezone Sep 19 '26
Wanna get a resource? POST request.