CODEWITHSUNDEEP
resthttp
John Donn
John Donn

Reputation: 1858

HTTP status code for PATCH requests meaning "you are not allowed to make such request"

I am trying to implement some PATCH requests in our software(following https://www.rfc-editor.org/rfc/rfc7396). The resources have some fields which must not be modified, so I am thinking to return some error status code when such fields appear in HTTP JSON request body. 400 seems a bit too generic (I am using it for validation errors e.g. email format and the like). Perhaps there is some other status code used in such situations?

Upvotes: 2

Views: 4625

Answers (2)

Terry Carmen
Terry Carmen

Reputation: 3886

There's a code for that . . . 8-)

403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason

https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

Furthermore, 403 is suitable even if there are no credential problems. This is explained in RFC7231 Section 6.5.3:

a request might be forbidden for reasons unrelated to the credentials

Upvotes: 5

VoiceOfUnreason
VoiceOfUnreason

Reputation: 57249

RFC 7231 section 8.2 a status code registry, so that's the place to start.

This is clearly a problem with the request; something the client might be able to fix, so an entry from the 4xx class is appropriate.

405 Method Not Allowed is wrong for the case you describe -- a different merge patch document would be accepted by this resource, but not the one that is present.

403 Forbidden is wrong, as it communicates a problem related to credentials, but you are describing a problem with payload.

409 Conflict could be reasonable...

the request could not be completed due to a conflict with the current state of the target resource.

I don't see any reason that the conflict can't be in an immutable part of the "current state".

But I think your best bet is 422 Unprocessable Entity

The 422 (Unprocessable Entity) status code means the server understands the content type of the request entity (hence a 415(Unsupported Media Type) status code is inappropriate), and the syntax of the request entity is correct (thus a 400 (Bad Request) status code is inappropriate) but was unable to process the contained instructions. For example, this error condition may occur if an XML request body contains well-formed (i.e., syntactically correct), but semantically erroneous, XML instructions.

Another good resource to consider is the HTTP Patch specification. RFC 5789 enumerates a number of reasons that a patch might fail, and what code would be appropriate to use in each context. You can decide for yourself whether you think those distinctions are appropriate in your circumstances.

There may also be more specific errors like "Conflicting State" that could be signaled with this status code, but the more specific error would generally be more helpful.

Upvotes: 1

Related Questions