Programming

Should HTTP PUT create a resource if it does not exist?

I first came across this question in Stack Overflow and I did provide an answer to it. As my answer has been getting some upvotes recently, I thought it would deserve a cross-post here.

Should HTTP PUT create a resource if it does not exist?

The ultimate decision comes down to how the resource identifiers are generated:

  • If the server allows the client to generate resource identifiers, then it would be fine to use PUT for creating resources.
  • On the other hand, if the server generates resource identifiers on behalf of the client, then POST should be used instead of PUT for creating resources.

Some parts of the PUT method definition are quoted below and the last sentence supports what I have just mentioned above (highlight is mine):

4.3.4. PUT

The PUT method requests that the state of the target resource be created or replaced with the state defined by the representation enclosed in the request message payload. […]

If the target resource does not have a current representation and the PUT successfully creates one, then the origin server MUST inform the user agent by sending a 201 (Created) response. If the target resource does have a current representation and that representation is successfully modified in accordance with the state of the enclosed representation, then the origin server MUST send either a 200 (OK) or a 204 (No Content) response to indicate successful completion of the request. […]

Proper interpretation of a PUT request presumes that the user agent knows which target resource is desired. A service that selects a proper URI on behalf of the client, after receiving a state-changing request, SHOULD be implemented using the POST method rather than PUT. […]

Now, for the sake of completeness, I added below some relevant quotes on the POST method definition:

4.3.3. POST

The POST method requests that the target resource process the representation enclosed in the request according to the resource’s own specific semantics. For example, POST is used for the following functions (among others):

[…]

  • Creating a new resource that has yet to be identified by the origin server;

[…]

If one or more resources has been created on the origin server as a result of successfully processing a POST request, the origin server SHOULD send a 201 (Created) response containing a Location header field that provides an identifier for the primary resource created and a representation that describes the status of the request while referring to the new resource(s).

While the 201 status code indicates that a new resource has been created, the Location header indicate where the newly created resource is located. If no Location header is provided, then the client should assume that the resource is identified by the effective request URI:

6.3.2. 201 Created

The 201 (Created) status code indicates that the request has been fulfilled and has resulted in one or more new resources being created. The primary resource created by the request is identified by either a Location header field in the response or, if no Location field is received, by the effective request URI. […]