I'm new to WP-REST and need to build a REST API for a wordpress project, but I'm somehow wondering about one aspect. Good practices say, and the built-in WP API for posts also shows, that you should use only nouns in routes, and let the HTTP methods
like GET
, POST
, PUT
, and DELETE
define what the respective endpoint does. For this, let's assume you have something like:
- Base route: https://example.org/api/v1/customers
And with that route, you use:
GET https://example.org/api/v1/customers/<id>
to get a customerPOST https://example.org/api/v1/customers
+ payload to create a customerPUT https://example.org/api/v1/customers/<id>
+ payload to update a customerDELETE https://example.org/api/v1/customers/<id>
to delete a customer
Using this design, and extending it to relational endpoints, with sth like:
GET https://example.org/api/v1/customers/<id>/products/<prod_id>
to get a customer's product XDELETE https://example.org/api/v1/customers/<id>/products/<prod_id>
to delete a customer's product X
However exposes practially your entire backend schema, including relationships of your tables or what they most likely are, to the public. I thus consider this as a security risk; and wanted to double-check: Am I missing out some fundamentals of REST API design? Or are you indeed supposed to expose your surrogate keys in REST APIs, like wordpress does it for example for posts?