CRUD Operations in REST APIs

# CHAPTER 6

CRUD Operations in REST APIs #

1. Introduction #

2. Learning Objectives #

• Map CRUD database operations directly to REST endpoints.

• Parse incoming JSON request bodies for Create and Update operations.

• Extract Path Parameters to identify resources for Read and Delete operations.

• Construct standard JSON response structures for successful operations.

3. Beginner-Friendly Explanation #

• Read (GET): You want to see all your contacts, or just one specific contact's phone number.

• Create (POST): You met a new friend and want to add their name and number to the book.

• Update (PUT/PATCH): Your friend changed their phone number, and you need to correct their entry.

• Delete (DELETE): You are no longer friends, so you erase them from the book entirely.

A REST API is simply a programmable wrapper around this contact book, allowing external applications to perform these four actions securely.

4. Setup: The In-Memory Database #

const express = require('express');
const app = express();
app.use(express.json()); // CRITICAL: Tells Express to parse incoming JSON!

// Our "Database"
let users = [
    { id: 1, name: "Alice", role: "admin" },
    { id: 2, name: "Bob", role: "user" }
];
let nextId = 3;

5. READ Operations (GET) #

1. Get Collection:

// Endpoint: GET /api/users
app.get('/api/users', (req, res) => {
    // 1. Fetch all data from DB
    // 2. Return 200 OK with data
    res.status(200).json({
        status: "success",
        data: users
    });
});

2. Get Singleton:

// Endpoint: GET /api/users/1
app.get('/api/users/:id', (req, res) => {
    // Extract the ID from the URL (Path Parameter)
    const userId = parseInt(req.params.id);
    
    // Search the database
    const user = users.find(u => u.id === userId);
    
    // If not found, return 404!
    if (!user) {
        return res.status(404).json({ error: "User not found" });
    }
    
    res.status(200).json({ data: user });
});

6. CREATE Operations (POST) #

// Endpoint: POST /api/users
// Client sends: { "name": "Charlie", "role": "user" }
app.post('/api/users', (req, res) => {
    // 1. Extract data from the Request Body
    const { name, role } = req.body;
    
    // 2. Basic Validation (Chapter 9 covers this deeply)
    if (!name || !role) {
        return res.status(400).json({ error: "Name and role are required." });
    }
    
    // 3. Create the new database record
    const newUser = { id: nextId++, name: name, role: role };
    users.push(newUser);
    
    // 4. Return 201 Created AND the newly created object!
    res.status(201).json({
        message: "User created successfully",
        data: newUser
    });
});

7. UPDATE Operations (PUT / PATCH) #

// Endpoint: PUT /api/users/1
app.put('/api/users/:id', (req, res) => {
    const userId = parseInt(req.params.id);
    const { name, role } = req.body;
    
    // Find the user
    let userIndex = users.findIndex(u => u.id === userId);
    if (userIndex === -1) return res.status(404).json({ error: "User not found" });
    
    // Update the record
    users[userIndex].name = name || users[userIndex].name;
    users[userIndex].role = role || users[userIndex].role;
    
    res.status(200).json({
        message: "User updated",
        data: users[userIndex]
    });
});

8. DELETE Operations (DELETE) #

// Endpoint: DELETE /api/users/1
app.delete('/api/users/:id', (req, res) => {
    const userId = parseInt(req.params.id);
    
    const userIndex = users.findIndex(u => u.id === userId);
    if (userIndex === -1) return res.status(404).json({ error: "User not found" });
    
    // Erase from database array
    users.splice(userIndex, 1);
    
    // Return 204 No Content. (No JSON body needed!)
    res.status(204).send();
});

9. Best Practices #

• Return the Created Object: When a client POSTs data to create a record, the database generates dynamic data (like an Auto-Increment ID, or a created_at timestamp). Always return the complete, newly generated object in the 201 Created response. The client needs that generated ID to interact with the object later!

10. Common Mistakes #

• Forgetting Body Parsers: If you try to run the POST code above, and req.body.name is always undefined, it is because the server does not know how to translate incoming raw HTTP text into a JSON object. In Express, you MUST include app.use(express.json()) at the top of your file to enable JSON parsing.

11. Exercises #

1. 1. Look at the POST and PUT examples. Which part of the HTTP request holds the data the client wants to save?

1. 2. Why does the GET /api/users/:id endpoint not require reading the req.body?

12. Coding Challenges #

• Challenge: Conceptualize a new Express endpoint: PATCH /api/users/:id/ban. If this endpoint is hit, it finds the user by ID and sets a hypothetical isBanned property to true. Do you need a request body for this? Write out the logic conceptually.

13. MCQs with Answers #

14. Interview Questions #

• Q: Walk me through the implementation of a full CRUD REST API for a "Products" table. Detail the HTTP Methods, the endpoint URLs, and how you extract the necessary data (Path Params vs Body) for each operation.

• Q: Explain why the DELETE method typically returns a 204 No Content status code. What does this code explicitly signal to the frontend client?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #