Separate API paths for read and write actions?

[phax]

Based on the discussion comment #259 (reply in thread) I want to know your opinion on the topic of security.

Currently the reading and writing API often use the same URL pattern (like /{ServiceGroupId}) just with a different HTTP verb (GET, PUT and DELETE) - see https://github.com/phax/phoss-smp/wiki/REST-API for all details.

Now I am wondering if the next major version of phoss SMP (v8) should define a constant path prefix (like /api) for the writable API (everything using PUT and DELETE). That would mean (at least):

• Existing API calls will break and would need to be adopted
• Existing Reverse Proxy configurations need to be adopted (and eventually simplified)
• Creating a secure setup would eventually be simplied
• Philosophically it would also break the REST paradigm (which the SMP doesn't really follow anyway)

For example the API PUT /{ServiceGroupId} would be changed to PUT /api/{ServiceGroupId}.

Additionally, if you are positive on the above topic, should all the non-standard GET (reading) API calls also be moved to a special path like /api? That would also effect APIs like GET /complete/{ServiceGroupId} etc.
The impact of that is very similar to the above one.

The only APIs that can NOT be moved are the standardized ones. These are currently (from a Peppol API perspective):

• GET /{ServiceGroupId}
• GET /{ServiceGroupId}/services/{DocumentTypeId}
• GET /businesscard/{ServiceGroupId}

[iansmirlis]

I guess this change cannot be implemented as optional, right?

[phax]

It would increase complexity and consistency. Would make my life much harder in support if everyone can configure their own API. I want that to be unified

[phax]

Well a total of 7 people participated which is quite low. The total majority also voted on not to change anything - so I will not change anything: