HTTP Methods & Status Codes

1. The Zomato Order Flow = All 4 HTTP Methods

Think of an API like talking to a waiter. You don't just say "pizza". You specify the action:

CRUD = Create POST, Read GET, Update PUT, Delete DELETE. That's it.

2. Status Codes = The Server's Reply

After you send a request, server replies with a 3-digit code. Learn these 5:

3. Code It: Zomato Order API

Add to your ZomatoController from last lesson:

// GET: api/zomato/restaurants/1
[HttpGet("restaurants/{id}")]
public ActionResult GetRestaurant(int id) {
    var r = restaurants.Find(x => x.Id == id);
    return r == null? NotFound() : Ok(r); // 404 or 200
}

// POST: api/zomato/orders
[HttpPost("orders")]
public ActionResult CreateOrder([FromBody] Order order) {
    order.Id = 123; // pretend we saved to DB
    return CreatedAtAction(nameof(GetOrder), new { id = order.Id }, order); // 201
}

[HttpGet("orders/{id}")]
public ActionResult GetOrder(int id) {... }

Test in Swagger: POST an order → get 201. GET wrong ID → get 404. You're speaking HTTP now.

1. Theory: Idempotence - The Interview Filter

Idempotent = Calling it 1 time or 100 times has same result.

• GET, PUT, DELETE are Idempotent: DELETE /orders/123 10 times = order deleted once. Safe to retry.
• POST is NOT Idempotent: POST /orders 10 times = 10 pizzas at your door. Not safe to retry.

Interview Q: "Payment failed, user clicked Retry. Which method?"
Wrong: "POST" → You double-charged them.
Right: "Make payment endpoint idempotent. Client sends unique Idempotency-Key. Server checks if seen before."

2. PUT vs PATCH - The Senior Debate

Rule: Use PUT 90% of time. PATCH is complex. Only use if bandwidth matters or object is huge.

3. Status Codes: The Full 2xx, 4xx, 5xx Story

2xx = Success. You did it.

• 200 OK - General success. GET/PUT/DELETE.
• 201 Created - POST success. Must include Location header.
• 204 No Content - DELETE success. Nothing to return.

4xx = Client Error. You messed up.

• 400 Bad Request - JSON invalid, missing field. Your fault.
• 401 Unauthorized - No token sent. Who are you?
• 403 Forbidden - Token valid, but you're not admin. You can't do that.
• 404 Not Found - ID doesn't exist.

5xx = Server Error. We messed up.

• 500 Internal Server Error - Null reference exception. Our code crashed.
• 503 Service Unavailable - DB is down. Try later.

4. The CreatedAtAction Pattern

Theory: REST says after POST, return 201 + Location header pointing to new resource.

[HttpPost]
public ActionResult Create(Order o) {
    o.Id = 123; // save to DB
    // This returns 201 + Header: Location: /api/orders/123
    return CreatedAtAction(nameof(GetOrder), new { id = o.Id }, o);
}

Why: Lets client immediately GET the new order without hardcoding URL. This is professional REST.