The fundamentals of a good REST API have not been replaced in 2026: use HTTP methods according to their defined behavior, make retries safe where possible, and keep the API contract aligned with what the service actually does. The practical updates are to use RFC 9457 for HTTP problem details, treat OpenAPI as an operational contract, and choose Spring’s outbound HTTP client to match the application’s programming model.
What actually changed for REST APIs in 2026?
There is no new set of REST rules that makes the established HTTP semantics obsolete. RFC 9110 remains the foundation for method behavior and retry decisions. The meaningful updates are in the standards and tooling teams use around that foundation:
As an Amazon Associate I earn from qualifying purchases.
- Error responses: RFC 9457 is the current HTTP Problem Details specification; it obsoletes RFC 7807.
- API contracts: OpenAPI descriptions can support documentation, code generation, and testing, rather than serving only as reference pages.
- Spring examples: Spring supports Problem Details in MVC, and its documented client choice distinguishes imperative applications from reactive ones.
These are updates to how teams express, document, and implement an API—not a reason to change a resource-oriented design that already follows HTTP semantics.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Design endpoints around HTTP behavior
Use safe methods only to read
RFC 9110 defines GET, HEAD, OPTIONS, and TRACE as safe methods: clients can expect that invoking them does not request a state change. In practice, a GET request should not perform an action such as placing an order, charging a payment method, or deleting a record. A crawler, prefetcher, or client retrying a read must not accidentally trigger a consequential operation.
#1 Best Overall
Represent changes with methods whose semantics match the operation. Use POST to submit a command or create a subordinate resource, PUT to replace a resource representation at a known URI, PATCH for a partial update when the API defines the patch format, and DELETE to request removal. The exact resource model is application-specific; the important rule is that the method’s externally visible behavior must not mislead clients.
Make retries an explicit design concern
RFC 9110 defines PUT and DELETE as idempotent, as well as safe methods. Idempotency means repeating the same request has the same intended effect as applying it once; it does not promise identical response bodies or eliminate every side effect inside an implementation.
A timeout after a client sends a request does not establish that the server failed to apply it. The server may have committed a change while the response was lost. RFC 9110 therefore says clients should not automatically retry a non-idempotent request unless they can establish that its semantics are actually idempotent or detect that the original request was never applied.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For an operation such as creating a payment or submitting an order, decide how clients can safely recover from an uncertain result. One common application-level approach is a documented idempotency key backed by server-side deduplication, but its exact behavior—scope, retention period, and response to reuse—must be part of that API’s contract. Do not assume that retrying POST is safe simply because a client library offers automatic retries.
Return useful, safe error responses
Use Problem Details for HTTP-level failures
RFC 9457 defines a machine-readable format for explaining problems with an HTTP interface. A response commonly uses the media type application/problem+json and includes fields such as type, title, status, detail, and instance. Use the status code for the broad HTTP outcome and the problem document to give clients stable, actionable context.
For example, a client that requests an order that does not exist could receive a 404 response with a stable problem type and a concise explanation. If clients need an application-specific code, add a documented extension such as code. Keep extension names and meanings stable: clients should not have to parse a human-oriented detail sentence to decide how to respond.
Problem Details is not a universal wrapper for every response. RFC 9457 notes that an existing domain representation may be more appropriate when the response is still a representation of a resource. Use a problem document to describe an HTTP-interface problem, not to replace ordinary resource data.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKeep diagnostics out of client responses
Problem responses should help a client understand what it can do next, not expose how the server failed internally. RFC 9457 explicitly warns against treating problem details as a debugging tool. Do not return stack traces, secrets, internal hostnames, SQL statements, or implementation-specific exception messages. Record diagnostic detail in protected server logs and give clients a safe correlation identifier when support workflows require one.
Spring MVC example
Spring Framework supports RFC 9457 Problem Details in MVC. A controller advice can extend ResponseEntityExceptionHandler for framework-handled MVC exceptions and add application-specific mappings for domain exceptions. This example illustrates the pattern; verify imports and API signatures against the Spring Framework version used by the application.
Rank #4
@RestControllerAdvice
class ApiExceptionHandler extends ResponseEntityExceptionHandler {
@ExceptionHandler(OrderNotFoundException.class)
ProblemDetail handleOrderNotFound(OrderNotFoundException exception) {
ProblemDetail problem = ProblemDetail.forStatusAndDetail(
HttpStatus.NOT_FOUND,
"No order exists for the requested identifier."
);
problem.setTitle("Order not found");
problem.setProperty("code", "ORDER_NOT_FOUND");
return problem;
}
}The custom handler returns a stable code without exposing the exception’s internal message. Define the public problem types and extension fields in the API contract so clients can rely on them.
Choose Spring’s outbound HTTP client for the application model
Spring Boot’s documented guidance associates RestClient with imperative applications and WebClient with reactive applications. Choose according to how the application executes and composes work, not because one client is newer or fashionable.
| Application model | Spring client | Use it when |
|---|---|---|
| Imperative | RestClient |
The application makes blocking calls in a conventional synchronous flow. |
| Reactive | WebClient |
The application uses WebFlux or needs reactive, non-blocking composition. |
The Spring Boot reference surfaced for this article identified version 4.1.1 as the latest stable release at the time of that check. Spring releases change, so confirm the version and APIs in the official reference for the release you use. The example below shows the imperative client pattern; it is not a claim that the code was compiled or tested here.
@Bean
RestClient inventoryClient(RestClient.Builder builder) {
return builder
.baseUrl("https://inventory.example")
.build();
}
InventoryItem item = inventoryClient.get()
.uri("/items/{id}", itemId)
.retrieve()
.body(InventoryItem.class);For a reactive application, use WebClient and preserve the reactive flow instead of blocking to imitate the imperative example. In either model, decide how the integration handles timeouts, non-success responses, and retries. A client’s retry configuration must respect the method’s semantics and the possibility that the server applied a request before the connection failed.
Make OpenAPI match the running API
OpenAPI can describe paths, methods, request and response schemas, status codes, and security requirements in a form usable by documentation, code-generation, and testing tools. The official specification surfaced for this article is OpenAPI 3.2.1; that version label is not a guarantee that every validator, generator, or client tool in a project supports it. Select a version the service’s tooling can handle.
There are two common ways to maintain the description. A team can author a contract first and use it to guide implementation, or generate a description from a Spring application with a tool such as springdoc-openapi, which inspects runtime configuration, classes, and annotations. The first approach makes the contract an explicit design artifact; the second can reduce duplicated documentation. Neither prevents drift by itself: generated descriptions can still omit behavior, and hand-authored contracts can fall behind code.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Document the actual success and error responses, including status codes and schemas.
- Describe authentication and authorization requirements where they apply.
- Include stable problem types and extension fields that clients are expected to interpret.
- Validate the contract in the build or test workflow, and review changes against observable endpoint behavior.
Springdoc-openapi releases align major versions with Spring Boot major versions, so check compatibility before adopting or upgrading it. Keep generated or hand-authored descriptions synchronized with the deployed behavior rather than treating a successful build as proof that the contract is accurate.
Quick Recap
A practical review checklist
- Does each method’s behavior match its HTTP semantics, especially for GET and other safe methods?
- Can a client tell whether an uncertain request is safe to retry, and does the API document the safeguards for non-idempotent operations?
- Do errors provide a stable HTTP status and, where appropriate, an RFC 9457 problem document without leaking implementation details?
- Does the OpenAPI contract cover the real request, response, security, and error behavior?
- Does each Spring outbound client match the application’s imperative or reactive model, and is its version compatible with the project’s Spring Boot release?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
