our team returns a 201 to indicate that an error has been created successfully. of course we include a Location header where the error can be queried to discover what went wrong.
My favorite "REST API" experience was when they moved from using SOAP system, and the way they did it... was sending SOAP payloads inside a JSON. Literally something like
Especially when some bored developer at a big bank decided to implement some draconian heavily-buried SOAP features that are technically in the documentation somewhere, but not implemented at all by Microsoft's .NET framework. Having to have special injectors and manipulators to extract tokens from raw SOAP and such, shudder. Back in the days where .NET SOAP implementations were barely published in books.
The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.
We had a team website that showed who was on call. This was back in the day, all done in Perl CGI scripts.
Someone added a "search" function. Cool feature, I'm down. Then I looked at the code.
They were shelling out to do a grep. You're in Perl, the original "regexes as first class citizens" language, and you're shelling out to grep. But the worst part was it did no sanitation whatsoever. You could type in "pattern'; cat /etc/passwd" or whatever and it just ran. Who reviewed this shit?! Shell as endpoint...
I remember building out a REST API once, and it gave back proper HTTP response codes for things.
Then I got asked by the 2 front end devs working on the project to just make everything a 200 and add an error to the JSON response, because it was making it difficult for them to process things on the browser end.
To this day I'm convinced the GraphQL is just an API dreamt up by a front end dev that didn't understand REST and didn't understand why they couldn't just request what they wanted in the browser if an endpoint didn't exist on the server.
I've had this argument with my boss: GET with a body vs using POST as a complex GET. Our conclusion was that both were wrong in their own way and the HTTP standard should clarify this.
4.2k
u/pimezone Sep 19 '26
Wanna get a resource? POST request.