CRUD Operations and HTTP methods in RESTful services

What are these CRUD operations? You might be wondering so, as you read the topic of this post, or else you might have already heard this and is familiar with it. Though you might have not heard of the term CRUD, you'll probably have used CRUD operations if you have done computer programming for sometime. In RESTful services we use http methods to perform CRUD operations. Many programmers know which http method is used for a specific CRUD operation, but only a few knows the actual reason behind using that relevant http method for that particular operation. It is always better to learn things with reasoning, rather than blindly doing something just because everyone do so. In this blog post I'll give a brief introduction about CRUD operations and the four basic http methods and the reason why we use a particular http method for a specific CRUD operation.

What are CRUD operations? 

In computer programming CRUD stands for Create, Read, Update and Delete, which are the four basic functions of persistent storage. Each and every application that we develop is associated with some kind of a datastore, and most of the time the core functionality of the application lies in performing these four operations to our datastore. The term CRUD was first used by James Martin in his book Managing the Database Environment. There are also other variations for defining these same 4 operations:
BREAD: Browse, Read, Edit, Add, Delete
DAVE  : Delete, Add, View, Edit
CRAP   : Create, Replicate, Append, Process

The basic HTTP methods

The primary and the most commonly used http methods are GET, PUT, POST and DELETE. These four methods correspond to the CRUD operations that I described earlier. The features and the behavior of these methods are defined in the http specification. The most accepted convention of using these methods for CRUD operations are as follows:

1. GET: Used for reading or retrieving a set of data. If there is no error this http method  is most likely to return a status code of 200(OK). According to the http specification, this method is considered safe as long you do not use this to create or update resources.
2. POST: Used to create/add a new resource. Upon successful creation this method will return a status code of 201(Created). Considered as an unsafe method. Making two 2 identical POST requests will result in the creation of two resources containing the same information. 
3. PUT: Mostly used for updating an existing resource. Returns a status code 200 , on successful update. PUT is known as an idempotent method, meaning that the effect of performing n number of similar PUT requests, is same as for a single request. 
4. DELETE: As implied by the name itself, this method is used to delete a resource identified by a URI. On successful deletion this will return a status code of 200. 

Operation	HTTP method	RESTful  services
Create	POST, PUT	POST
Read (Retrieve)	GET	GET
Update (Modify)	PUT, POST	PUT
Delete (Destroy)	DELETE	DELETE

Despite this convention, in fact many http methods can be used to perform multiple CRUD operations. However the http specification strictly recommend us to follow the standard usage. But why?

Why not GET for creating?

Usually when a GET request is performed, data is added to the URL and the maximum length of the URL is 2048 characters, but when we are doing a POST request data is send in request body, hence we can send any amount of data with a POST request. Also, appending data to the URL and sending is insecure as everything is visible anyone through the URL(even sensitive, information like usernames and passwords will also be visible). POST on the other hand is comparatively secure than GET. Because of these reasons it is recommended to use POST for creating and GET only foe retrieving data.

Difference between POST and PUT

Actually both POST and PUT can be used to create resources. The key difference is that POST leaves it to the server to decide at what URI to make the resource available, whereas PUT instructs what URI to use. The point is that PUT will replace whatever the resource the URI was previously referring with new details, hence it is more suitable for updating . The whole idea is whether we are doing an idempotent change or not. Idempotent means (as I mentioned earlier), that the effect of making to identical requests is same as making that request once. PUT is idempotent, but POST is not. So, if we want an idempotent change it should be mapped to PUT, else it should be mapped to  POST. More simply speaking, it is always wise to use PUT for updating and POST for creating resources.

I hope this blog helped you to understand why it is better to follow the standard usage when using http methods for CRUD operations in RESTful services. 

You can download a simple REST API that I have created using the link below. I used node js, express js an MongoDB to develop this API. I have talked about all these technologies in my previous blogs, you can read them if you want to clarify anything. In this sample API , all CRUD operations are performed on book entity using http methods.

Simple REST API