api-guidelines/protocol/separate-concerns.md

Separate Concerns

Every API using HTTP/S API MUST clearly follow the concern separation of a HTTP message:

1. A resource identifier–URI MUST be used to indicate identity only (related: Content Negotiation, Changes and Versioning)
2. HTTP request method MUST be used to communicate the action semantics (intent and safety)
3. HTTP response status code MUST be used to communicate the information about the result of the attempt to understand and satisfy the request
4. HTTP message body MUST be used to transfer the message content
5. HTTP message headers MUST be used to transfer the metadata about the message and its content
6. URI query parameter SHOULD NOT be used to transfer metadata

NOTE: Rule No.1 means there MUST be NO information about the media type or version of resource in the URI (e.g. /greeting.json or /v2.1.3/greeting are illegal).

---

Keep things simple while designing by separating the concerns between the different parts of the request and response cycle. Keeping simple rules here allows for greater focus on larger and harder problems.

Requests and responses will be made to address a particular resource or collection. Use the path to indicate identity, the body to transfer the contents and headers to communicate metadata. Query params may be used as a means to pass header information also in edge cases, but headers are preferred as they are more flexible and can convey more diverse information.

– Heroku HTTP API Design Guide