In Rest APIs the convention followed for endpoints is to avoid naming them verbs like getAllStudents. But the problem I have been facing recently is, how to justify verification endpoint. For example I want to verify fingerprint of a user.
What should I name the endpoint? One way I thought of was POST /user/{id}/verify-fp. Is this correct??
Than I want to make an endpoint to get if user is locked or not. For that I can't think of any name. Please note I dont want to return any user data I just want to return if true or false, so the GET /users/{id} will not work for me.
There's definitely cases where 'good REST design' is not the best approach for every use-case. Although it's possible to stick to REST conventions and strictly thinks of endpoints in terms of transferring their full state, don't use verbs in URIs, etc, the pain of doing this for certain types of operations such as yours might not be worth it.
Endpoints like these certainly feel more RPC-like, and it's a better fit. So using POST at a well-named endpoint such as /user/{id}/verify-fp seems to be like a good place to make an exception.