What is the proper HTTP response code for request without mandatory fields

Question

Consider simple case where user is deleting a post. This is simple HTTP DELETE/POST request with one mandatory field, post_id.

What should server do if post_id is not provided?

Apparently, user should never encounter this behaviour, so let's be puristic.

My first take would be 400 bad request, but spec says

The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.

and I'd say missing field is OK from syntax/http POV, it's application domain-specific semantic requirement.

200 OK with explanations is bad, 500 feels weird as this is request problem.

Thoughs?

Solution 1

400 is the correct response.

400 is not restricted to a malformed syntax from an HTTP point of view. Missing a mandatory argument is an error in the syntax defined by the application and thus a "Bad Request"

EDIT

At first it seems strange that there is no separate return code for this, but the return codes are designed to differentiate in what actions the client should take. A 400 error code means that the client should change the POST data or query string to the format defined by the application. Hence it is appropriate for this case.

Solution 2

In a REST scenario, the resource to be deleted should be identified by the URL, so the ID of the resource should be a part of that URL in order to properly identify it. Once that assumption is correct, then the URL either is identifying a different resource fr deletion, or it isn't (which would give a 404)

In the general case of a missing parameter, however, I often use a 403 Forbidden error. The reasoning is that the request was understood, but I'm not going to do as asked (because things are wrong). The response entity explains what is wrong, so if the response is an HTML page, the error messages are in the page. If it's a JSON or XML response, the error information is in there.

From rfc2616:

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it.
Authorization will not help and the request SHOULD NOT be repeated.
If the request method was not HEAD and the server wishes to make
public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404
(Not Found) can be used instead.

Comments

[Lucero]

possible duplicate of What HTTP status response code should I use if the request is missing a required parameter?

[Will Curran]

Here is a list of RESTful Response Codes as well as some other information on best practices for REST: goo.gl/Nf9gt