Search code examples
restroutesrestful-url

REST: nested resource url when you don't want the parent ID visible

I read that the route for getting a nested resource in REST should look like this

/articles/:articleId/comments

The owner (:articleId) of the child resource will be visible.

But what if you have an owner that you don't want the client to know about?

For example, let's say I have an app where users have anonymous posts. I wouldn't want other users to see the client fetching the post by /users/123/post/321 because users could identify who wrote the post from the id and it wouldn't be anonymous.

Is the id necessary? Is it ok to instead do /users/posts/321 if all posts have a unique id?

Solution

  • There are no actual requirements for the URL format. It can be whatever you'd like it to be.

    If it were me, I would use simply /posts/321 and leave users out of it, since a particular user isn't specified in your URL at all. I think that's the clearest way to handle it in your case.