CRUD Operations in REST APIs

# CHAPTER 19

CRUD Operations in REST APIs #

1. Introduction #

2. Learning Objectives #

• Map the four CRUD operations to their respective HTTP methods and URLs.

• Understand the expected Request and Response payloads for each operation.

• Design a complete, standardized set of endpoints for a single resource.

• Identify the correct HTTP status codes for the success and failure of each CRUD action.

3. Beginner-Friendly Explanation #

• Create: Writing a new person's details into a blank page. (POST)

• Read: Flipping to a page to look at a person's phone number. (GET)

• Update: Erasing an old phone number and writing down their new one. (PUT/PATCH)

• Delete: Tearing the page out of the book entirely. (DELETE)

In REST, a "Resource" (like a User, a Product, or an Article) will almost always have these four operations associated with it.

4. Real-World Examples #

• Create: POST /playlists (Creates a new playlist)

• Read: GET /playlists/5 (Views playlist #5)

• Update: PUT /playlists/5 (Changes the name of playlist #5)

• Delete: DELETE /playlists/5 (Deletes playlist #5)

5. Detailed Code Examples #

<?php
header("Content-Type: application/json");
$method = $_SERVER[&#039;REQUEST_METHOD'];
$resourceId = $_GET[&#039;id'] ?? null;

switch ($method) {
    case &#039;POST':
        // CREATE
        // Logic: Read php://input, validate, INSERT into DB.
        http_response_code(201);
        echo json_encode(["message" => "Resource created", "id" => 101]);
        break;

    case &#039;GET':
        // READ
        if ($resourceId) {
            // Logic: SELECT * FROM table WHERE id = $resourceId
            echo json_encode(["data" => ["id" => $resourceId, "name" => "Item"]]);
        } else {
            // Logic: SELECT * FROM table (List view)
            echo json_encode(["data" => [ /* array of items */ ]]);
        }
        break;

    case &#039;PUT':
    case &#039;PATCH':
        // UPDATE
        if (!$resourceId) {
            http_response_code(400);
            echo json_encode(["error" => "ID required for update"]);
            break;
        }
        // Logic: Read php://input, UPDATE table WHERE id = $resourceId
        echo json_encode(["message" => "Resource updated successfully"]);
        break;

    case &#039;DELETE':
        // DELETE
        if (!$resourceId) {
            http_response_code(400);
            echo json_encode(["error" => "ID required for deletion"]);
            break;
        }
        // Logic: DELETE FROM table WHERE id = $resourceId
        http_response_code(204); // No Content
        break;
}
?>

6. Request/Response Examples #

1. Create (POST /tasks):

• Request: {"title": "Buy Milk"}

• Response: 201 Created -> {"id": 1, "title": "Buy Milk", "status": "pending"}

2. Read (GET /tasks/1):

• Request: Empty body

• Response: 200 OK -> {"id": 1, "title": "Buy Milk", "status": "pending"}

3. Update (PUT /tasks/1):

• Request: {"title": "Buy Milk", "status": "completed"}

• Response: 200 OK -> {"id": 1, "title": "Buy Milk", "status": "completed"}

4. Delete (DELETE /tasks/1):

• Request: Empty body

• Response: 204 No Content (Empty response body)

7. HTTP Examples #

• POST -> INSERT INTO...

• GET -> SELECT FROM...

• PUT / PATCH -> UPDATE...

• DELETE -> DELETE FROM...

8. JSON Examples #

{
  "meta": {
    "total": 2
  },
  "data": [
    { "id": 1, "title": "Task 1" },
    { "id": 2, "title": "Task 2" }
  ]
}

9. Best Practices #

• Standardized Responses: Ensure that a GET /tasks/1 returns the exact same JSON structure for a task as a POST /tasks returns upon creation. Consistency is key.

• Idempotency is crucial: Ensure your DELETE /tasks/1 can be clicked 5 times by a laggy client without crashing the server. If the record is already gone, simply return a 404 Not Found or a 204 No Content again.

• Soft Deletes: For critical data, don't actually run a SQL DELETE. Instead, run an UPDATE that sets a deleted_at timestamp. The API then filters out any records where deleted_at IS NOT NULL.

10. Common Mistakes #

• Forgetting the ID on Updates/Deletes: A common beginner error is making a PUT /tasks request without an ID, causing the SQL query to accidentally update *every single task* in the database to the new values!

• Returning HTML on errors: If your SQL query fails, make sure your PDO Exception is caught and returned as a JSON 500 Internal Server Error, rather than echoing a PHP fatal error screen.

11. Mini Exercises #

1. 1. Match the CRUD operation to the HTTP method:

• Create -> ? (POST)

• Read -> ? (GET)

• Update -> ? (PUT/PATCH)

• Delete -> ? (DELETE)

12. Coding Challenges #

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain how CRUD operations map to HTTP methods in REST.

• Q: What is a "Soft Delete," and how would you implement it in a REST API?

• Q: Why is it important for the GET /resource/{id} response structure to match the POST /resource response structure?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #