Restful Api: User id in each repository method?

I am new to both .Net & RESTful ser开发者_StackOverflow中文版vices.

Here is the object hierarchy I have in the database: Users->Folders->Notes.

The API: GET /api/note/{noteid}

would get mapped to the repository call

NoteRepository::GetNote(userId, noteId)

Notice that I am passing on the userId to make sure that the note belongs to the logged in user for security purpose.

Is this the right approach? Meaning, every repository call would have the first parameter as the userId to check if the object being accessed belongs to the user.

Is there any better approach?

You don't need the User Id since the

GET /api/note/{noteid}

is indeed unique.

A valid scenario for adding the id would be:

GET /api/{userId}/notes

And then if you want a specific note you can:

GET /api/{userId}/notes/{noteId}

I would implement security at the entry level. whether the user has rights to perform a method on that specific resource. A role model approach would be fine.

Regards.

I would also introduce the user id in the API, because of Stateless and Cacheable constraints described in the Wikipedia REST article.

However, if I check Google Tasks REST API, they don't include the user id, same thing for Twitter API, so it seems a trend not to include the user id. If someone can shed some light I would be grateful.

UPDATE: Thinking more about it, if the noteid is unique across all users, there is no need to include the user id, so a GET /api/note/{noteid} is fine.

However, the logical parent in a restful interface would be GET /api/note/ to get a list of all notes, and here I've the objection, since the list would differ according to the user requesting it, making it non cacheable.

As for your dot net part I think that passing the userid among dot net methods is perfectly fine.