Search code examples
restrestful-architecture

Context dependent REST API strategies


What strategies would you suggest for making a RESTful API "context dependent"?

Let me elaborate.

On a project that I'm working on we are exposing a resource Team. Users can create their own teams, which results in a POST /teams request to the API. The request is validated using set of rules meant for user created teams.

We also have an administration interface which is used by certain users to create the same type of Team resource, however this is governed by a slightly different set of validation rules.

Administrators may use either our public or administration interface, and so the validation has to happen based on their context, not the user's capabilities.

To rephrase the question above for this specific situation: How do we separate between these two contexts in a RESTful way? Do we create two different resources even if the "result" is of the same type, and if so what naming conventions would you suggest?


Solution

  • I believe what you should do is create a 'user-level' token or just a user for each admin that they should use when they want the public interface.

    There is only one interface, namely /teams in terms of REST API, and your token can decide the validation rules.

    Or if each admin is responsible from a team I'd design /admins/x/teams endpoint to validate differently and only accept x's authentication. sub-resources are still RESTful.