October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk5 min

How to Design a REST API: Routes, Status Codes, and Error Responses

A standards-led guide to resource-based routes, HTTP method semantics, status-code choices, and safe, structured API error responses.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Design a REST API by giving each URI a clear resource meaning, using HTTP methods according to their standard semantics, choosing status codes that match the outcome, and returning structured error details when clients need more than the status alone. Noun-based routes and plural collection names are useful conventions—not rules imposed by HTTP. This guide shows how to apply them without treating any one organization’s style as universal.

How should REST API routes be structured?

Start with the resources in your domain, then give each collection, individual resource, or subordinate resource a stable URI. For example, an order collection might be /orders, with an individual order at /orders/{orderId}. The method tells the server what the client wants to do with that target.

As an Amazon Associate I earn from qualifying purchases.

Microsoft’s API design guidance recommends resource-oriented, noun-based URIs and commonly uses plural nouns for collections. Google’s API design guide is another official reference for resource-oriented naming. These are design conventions, not a universal URI law: HTTP does not forbid every verb-like path or custom operation. The goal is a consistent interface that remains understandable without exposing implementation details.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Target Example request Typical intent
Collection GET /orders Retrieve the collection or a selected representation of it.
Individual resource GET /orders/{orderId} Retrieve the identified order.
Collection POST /orders Submit data to create an order, subject to the API’s contract.
Individual resource PUT /orders/{orderId}, PATCH /orders/{orderId}, or DELETE /orders/{orderId} Replace, partially modify, or delete the identified resource, according to the method semantics and API contract.

These examples are a starting pattern, not a complete contract. Choose identifiers, collection boundaries, and nesting to reflect the domain. A path such as /create-order often duplicates information that can be conveyed by POST /orders; reserve custom action patterns for cases where ordinary resource manipulation does not express the domain operation clearly, and document them.

#1 Best Overall
API Design Patterns
  • API Design Patterns
  • ABIS BOOK
  • Manning Publications

How should the HTTP method shape behavior?

The URI identifies the target; the method communicates the requested operation. Use the definitions in RFC 9110, HTTP Semantics when deciding what a method guarantees, including whether it is safe or idempotent. Do not assign a state-changing operation to GET, or treat methods with different semantics as interchangeable.

GET, POST, PUT, PATCH, and DELETE are commonly used in web APIs, but their exact behavior depends on the method definition and the API’s documented contract. Collection and item targets can lead to different outcomes: for example, POST to a collection may create a resource, while a request to an item URI addresses that specific item. Design for what clients can safely infer from the method, not just for convenient controller naming.

How do you choose an HTTP status code?

Choose the status that accurately describes the HTTP outcome. RFC 9110 defines status codes as three-digit integers from 100 through 599 and groups them into five classes. Clients are expected to understand the class even if they do not recognize a particular registered code.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Class Meaning Design use
1xx Informational Indicates that the request has been received and processing continues.
2xx Successful Indicates that the request succeeded.
3xx Redirection Indicates that further action is needed to complete the request.
4xx Client error Indicates that the request has a problem attributed to the client.
5xx Server error Indicates that the server failed to fulfil an apparently valid request.

Common examples include 200 for a successful response with a representation, 201 when creation has succeeded, 204 for success without response content, 400 for a client error such as malformed syntax or invalid framing, and 404 when the target resource is not found. Treat these as examples, not a substitute for checking the exact semantics in RFC 9110; the right choice depends on the operation and what the server knows about the target.

Do not return 200 with an error object merely to simplify client handling. The status is meaningful to generic HTTP clients, gateways, monitoring, and retry logic. The body can explain application-specific validation or business-rule details that the status cannot carry by itself.

How should an API represent errors?

For a reusable JSON error format, consider RFC 9457 Problem Details for HTTP APIs, published by the IETF in July 2023. It obsoletes RFC 7807 and defines the JSON media type application/problem+json. Problem Details can be used with any status, but it fits most naturally with 4xx and 5xx responses. A generic status may be enough when no additional explanation helps; an existing application representation may be better when the response is still a representation of a resource.

The standard members have distinct roles:

  • type identifies the kind of problem with a URI. Use about:blank when the problem adds no semantics beyond the HTTP status.
  • title is a short, stable summary of the problem type, apart from localization.
  • status can state the HTTP status generated for this occurrence. If the response includes it, the generator must use the same code in the actual HTTP response.
  • detail explains this occurrence in human-readable terms and should help the client correct the problem. Clients should not parse this prose to drive program logic.
  • instance can identify the specific occurrence, for example with a URI reference, when that is useful.
  • Extension members can carry documented, structured information such as validation locations when clients need machine-readable detail.

A validation response could look like this illustrative example. The errors member is an API-specific extension, not a standard RFC 9457 field; document its shape and stability if clients depend on it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{
  "type": "https://api.example.com/problems/validation-error",
  "title": "Request validation failed",
  "status": 400,
  "detail": "One or more fields need correction.",
  "instance": "/problem-occurrences/7f3a",
  "errors": [
    {
      "field": "shippingAddress.postalCode",
      "code": "invalid_format"
    }
  ]
}

Here the field path and code are illustrative API design choices. Stable structured fields give software a way to respond to errors without scraping the wording of detail. Keep any extension documented and consistent across endpoints where the same problem occurs.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What should an error response reveal?

Make an error useful without turning it into a debugging channel. Explain what the client can do next when that is safe, but do not expose stack traces, secrets, internal topology, or sensitive implementation details. Problem Details separates a stable machine-readable identity from occurrence-specific explanation, so clients can branch on documented fields rather than brittle prose.

Use a problem type only when the API needs to communicate meaning beyond the status. RFC 9457 cautions against redefining status-code semantics: an error body supplements the protocol-level result; it does not replace it. The standard’s abstract describes its purpose as carrying “machine-readable details of errors in HTTP response content to avoid the need to define new error response formats for HTTP APIs.”

A practical design check before publishing

  • Does each URI clearly identify a collection, a resource, or a subordinate resource?
  • Does the method’s standard meaning fit the operation, including its safety and repeatability expectations?
  • Does the status code accurately describe the HTTP result rather than masking an error as success?
  • Can a client understand the general result from the status and get useful application detail from the body where needed?
  • Are problem-type identifiers and extension fields stable and documented for client use?
  • Does the error detail help without disclosing private or internal information?

These choices establish a coherent route, method, status, and error model. Authentication, pagination, versioning, and the full domain-to-status mapping still depend on the API’s requirements and are not determined by these conventions alone.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.