spring-boot-rest-api-standards

Spring Boot REST API Standards

Overview

REST API design standards for Spring Boot covering URL design, HTTP methods, status codes, DTOs, validation, error handling, pagination, and security headers.

When to Use

• Creating REST endpoints and API routes
• Designing DTOs and API contracts
• Implementing error handling and validation
• Setting up pagination and filtering
• Configuring security headers and CORS
• Reviewing REST API architecture

Instructions

To Build RESTful API Endpoints

Follow these steps to create well-designed REST API endpoints:

1. Design Resource-Based URLs

   • Use plural nouns for resource names
   • Follow REST conventions: GET /users, POST /users, PUT /users/{id}
   • Avoid action-based URLs like /getUserList

2. Implement Proper HTTP Methods

   • GET: Retrieve resources (safe, idempotent)
   • POST: Create resources (not idempotent)
   • PUT: Replace entire resources (idempotent)
   • PATCH: Partial updates (not idempotent)
   • DELETE: Remove resources (idempotent)

3. Use Appropriate Status Codes

   • 200 OK: Successful GET/PUT/PATCH
   • 201 Created: Successful POST with Location header
   • 204 No Content: Successful DELETE
   • 400 Bad Request: Invalid request data
   • 404 Not Found: Resource doesn't exist
   • 409 Conflict: Duplicate resource
   • 500 Internal Server Error: Unexpected errors

4. Create Request/Response DTOs

   • Separate API contracts from domain entities
   • Use Java records or Lombok @Data/@Value
   • Apply Jakarta validation annotations
   • Keep DTOs immutable when possible

5. Implement Validation

   • Use @Valid annotation on @RequestBody parameters
   • Apply validation constraints (@NotBlank, @Email, @Size, etc.)
   • Handle validation errors with MethodArgumentNotValidException

6. Set Up Error Handling

   • Use @RestControllerAdvice for global exception handling
   • Return standardized error responses with status, error, message, and timestamp
   • Use ResponseStatusException for specific HTTP status codes

7. Configure Pagination

   • Use Pageable for large datasets
   • Include page, size, sort parameters
   • Return metadata with total elements, totalPages, etc.

8. Add Security Headers

   • Configure CORS policies
   • Set content security policy
   • Include X-Frame-Options, X-Content-Type-Options