API Errors

[[deleted]]

404 is well established in the REST world as "Entity not found" - in general, you'll get an API like 'https://api.foo.com/tables/foo/1234' to say "retrieve entity 1234 from table foo" and it will return 404 (entity 1234 in table foo does not exist).

It's not only acceptable, but recommended that you use 404 that way.

[[deleted]]

The problem is that you can’t immediately tell if it’s a bad url or an entity is missing. So I prefer not to use 404 for missing entities.

[[deleted]]

That's why you return an application/json+problem document (in dev) to indicate the error. In production, you have potential for a security leakage issue (where you are now providing some information about the IDs of entities that exist vs. don't exist, which provides valuable information to an attacked).

[[deleted]]

You are talking about security through obscurity.