CODEWITHSUNDEEP
httpcrudrest
fullStackChris
fullStackChris

Reputation: 1502

Is POST the correct HTTP verb for resources that are produced by but not stored by the server?

Perhaps a partial duplicate of What is the correct http verb for a Download in a REST API? , though that is referring to a file download specifically.

In terms of CRUD operations, POST is the recommended HTTP verb for creating a resource. Does this still apply to creating resources, even if those resources are not persisted on the server? (i.e. stored in a database or similar) For example, generating some code based on code the client sent or converting a file and returning it to the client.

With such types of functionality, the server has indeed "created" something, though only in passing, returning or streaming it to the client, and not storing it in the traditional CRUD sense. I've always used POST for such functionality, but now I'm starting to double guess myself and think that those could have been GET endpoints the whole time.

Seems like a weird gray area in which neither HTTP verbs GET or POST completely match.

Upvotes: 1

Views: 556

Answers (2)

VoiceOfUnreason
VoiceOfUnreason

Reputation: 57259

Is POST the correct HTTP verb for resources that are produced by but not stored by the server?

Yes - or alternatively, it's the least incorrect choice to use.

POST serves many useful purposes in HTTP, including the general purpose of “this action isn’t worth standardizing.” -- Fielding, 2009

In 2020, the HTTP-WG adopted a proposal to define a method token for "GET with a body", which would give as an alternative to POST when we want to indicate to general purpose components that the request has safe semantics, so there should eventually be some registered method that is a better fit.

Upvotes: 2

Julian Reschke
Julian Reschke

Reputation: 42025

There is no gray area here.

If the state of the server changes, use an unsafe method like POST. If it does not, you can use a safe methof like GET, as long as you stay within the documented limitations of GET (no request body).

If you're looking for a safe method that does take a request body, you may want to look at https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-method-w-body/.

Upvotes: 1

Related Questions