RESTful - What should a DELETE response body contain

Question

Let's say I have an API where you can get users:

GET /RESTAPI/user/

And you can delete users by:

DELETE /RESTAPI/user/123

What is the RESTful convention on what the DELETE's response body should contain? I expected it should be the new list of all users which now doesn't contain the user with id 123 anymore.

Googling around didn't get me any satisfying answers. I only found opinions on how to do that, but isn't there a strict definition of RESTful Services?

This is NOT a duplicate of What should a RESTful API POST/DELETE return in the body? and What REST PUT/POST/DELETE calls should return by a convention? since this questions asks for a strict definition regarding DELETE. Those questions were answered by loose opinions only.

Answer 1

The reason you get no hard answers is because there is no hard RESTful standard. So I can only suggest that you create a hard standard and stick to it within your own APIs

I used this as a guide for RESTful services http://www.vinaysahni.com/best-practices-for-a-pragmatic-restful-api

It says respond with a 204 status and an empty body

I stick to those standards and document them well for anyone who wants to use my APIs

Answer 2

What is the RESTful convention on what the DELETE's response body should contain?

REST is an architectural style defined by Fielding in the chapter 5 of his dissertation and it describes a set of contraints for applications built with this architecture. REST is designed to be protocol indenpendent but the chapter 6 of the same dissertation describes how REST is applied over HTTP.

Once your REST application is designed on the top of the HTTP protocol, you should be aware of the HTTP semantics. And the semantis of the HTTP/1.1 protocol are currently described in the RFC 7231.

---

The response payload of a DELETE request that has succeeded may:

• Be empty or;
• Include a representation of the status of the action.

And the following response status codes are suitable for a DELETE request that has succeeded:

• 202: The request has been accepted for processing, but the processing has not been completed.
• 204: The server has successfully fulfilled the request and that there is no additional content to send in the response payload body.
• 200: The request has succeeded and the request payload includes a representation of the status of the action.

See the following quote from the RFC 7231:

If a DELETE method is successfully applied, the origin server SHOULD send a 202 (Accepted) status code if the action will likely succeed but has not yet been enacted, a 204 (No Content) status code if the action has been enacted and no further information is to be supplied, or a 200 (OK) status code if the action has been enacted and the response message includes a representation describing the status.

Answer 3

204 No Content is a popular response for DELETE and occasionally PUT as well.

However, if you are implementing HATEOAS, returning a 200 OK with links to follow may be more ideal. This is because a HATEOAS REST API provides context to the client. Think of the location a user application navigates to after successfully issuing a delete command. Here is a brief article excerpt with more discussion on this. See the blog article for a more complete discussion.

• Article: http://blog.ploeh.dk/2013/04/30/rest-lesson-learned-avoid-204-responses/

Avoid 204 responses if you're building a HATEOAS application.

This is a lesson about REST API design that I learned while building non-trivial REST APIs. In order to be as supportive of the client as possible, a REST API should not return 204 (No Content) responses.

From the service's perspective, a 204 (No Content) response may be a perfectly valid response to a POST, PUT or DELETE request. Particularly, for a DELETE request it seems very appropriate, because what else can you say?

However, from the perspective of a proper HATEOAS-aware client, a 204 response is problematic because there are no links to follow. When hypermedia acts as the engine of application state, when there are no links, there's no state. In other words, a 204 response throws away all application state.

This article covers POST, PUT, DELETE and GET. Here's the specific discussion on DELETE:

Responding to DELETE requests

A DELETE request represents the intent to delete a resource. Thus, if the service successfully handles a DELETE request, what else can it do than returning a 204 (No Content)? After all, the resource has just been removed.

A resource is often a member of a collection, or otherwise 'owned' by a container. As an example, http://foo.ploeh.dk/api/tags/rock represents a "rock" tag, but another way of looking at it is that the /rock resource is contained within the tags container (which is itself a resource). This should be familiar to Atom Pub users.

Imagine that you want to delete the http://foo.ploeh.dk/api/tags/rock resource. In order to accomplish that goal, you issue a DELETE request against it. If all your client gets back is a 204 (No Content), it's just lost its context. Where does it go from there? Unless you keep state on the client, you don't know where you came from.

Instead of returning 204 (No Content), the API should be helpful and suggest places to go. In this example I think one obvious link to provide is to http://foo.ploeh.dk/api/tags - the container from which the client just deleted a resource. Perhaps the client wishes to delete more resources, so that would be a helpful link.