When is it appropriate to use query parameters in RESTful API design? Select all that are correct

In RESTful API design, query parameters are used to modify or qualify the request for a resource without changing the resource's endpoint (URI). Their primary purpose is to control the representation of the resource returned. This includes filtering a collection of resources based on specific criteria (e.g., ?status=active), sorting, paginating, and controlling the level of detail in the response, often referred to as field selection or projection (e.g., ?view=summary). These uses are idempotent and do not alter the state of the resource on the server.

A. Passing sensitive data like usernames and passwords in query parameters is a severe security vulnerability, as they are exposed in URLs, server logs, and browser history.

C. Deleting an entire collection is a significant state-changing operation. REST principles dictate using the appropriate HTTP method, DELETE, on the collection's URI (e.g., DELETE /collection).

1. Google Cloud API Design Guide: In the "Standard Methods" section for the List method

it specifies how filtering should be implemented: "The List method should support filtering... The filtering syntax is formally defined by the AIP for filtering. It is recommended that resource services support filtering on all or most of their resource's fields." This directly supports using query parameters for filtering (Option D).

Source: Google Cloud. (n.d.). API Design Guide - Standard Methods. Retrieved from cloud.google.com/apis/design/standardmethods#list

2. Google Cloud API Design Guide: The guide also discusses field masks

which allow clients to specify which fields to return. This is a formal mechanism for controlling the level of detail in a response (Option B). The guide states

"The google.protobuf.FieldMask standard message type can be used with all standard methods to control which fields are read

returned

or updated." This is often implemented via a fields query parameter.

Source: Google Cloud. (n.d.). API Design Guide - FieldMask. Retrieved from cloud.google.com/apis/design/fieldmask

3. Apigee Documentation (Web API Design: The Missing Link): This guide emphasizes using HTTP methods for their intended purpose. It states

"Use HTTP methods to operate on your API’s resource collections and elements." It explicitly maps DELETE to "Delete a resource." This confirms that a DELETE request

not a query parameter

should be used for deletion (making Option C incorrect).

Source: Marsh

D. (2016). Web API Design: The Missing Link. Apigee. Page 18

"Use HTTP Methods."

4. OWASP Foundation (related to security principles in API design): While not a direct Apigee source

OWASP principles are foundational to secure API engineering. The "Improper Assets Management" and "Security Misconfiguration" sections implicitly warn against exposing sensitive data. The "REST Security Cheat Sheet" explicitly states: "Don't pass sensitive data in the URL." This directly invalidates passing credentials in query parameters (Option A).

Source: Open Web Application Security Project (OWASP). (n.d.). REST Security Cheat Sheet. Retrieved from cheatography.com/owasp/cheat-sheets/rest-security/