At the moment the REST API has the following endpoints:
v1/accounts/{accountId} [GET, OPTIONS, PATCH]
v1/devices/{deviceId} [OPTIONS, PATCH]
v1/auth [OPTIONS, POST]
v1/accounts/{accountId}/devices [GET, OPTIONS]
This is inconsistent, we read a user's devices by a GET on /accounts/{accountId}/devices but then update them (change the name) with a PATCH on /devices/{deviceId}.
The only person who's ever going to update a device is the user themselves. Nobody else is allowed to touch it, or even know about its existence.
The /devices/{deviceId} route should be moved to /accounts/{accountId}/devices/{deviceId}
At the moment the REST API has the following endpoints:
This is inconsistent, we read a user's devices by a GET on
/accounts/{accountId}/devicesbut then update them (change the name) with a PATCH on/devices/{deviceId}.The only person who's ever going to update a device is the user themselves. Nobody else is allowed to touch it, or even know about its existence.
The
/devices/{deviceId}route should be moved to/accounts/{accountId}/devices/{deviceId}