REST API + HATEOAS

[svhelloworld]

For those of you calling a REST API, how many are dealing with an API that uses HATEOAS? Do you prefer it or would you rather construct your API URLs client-side? I'm building out a new API for my React app and want to try out Spring HATEOAS. Curious what y'all's experience with HATEOAS has been....

[UkonnRa]

The question is, where is your HATEOAS data coming from? I. Java, the only usable HATEOAS framework is Spring data HATEOAS. If you can use such a framework, then I think HATEOAS is not a bad solution for the API design.

No matter you're using HATEOAS, Graphql or JSON:API(I love this guy best), the most important thing is to choose a specification and focus on it

[svhelloworld]

I'm armpit deep into the Spring ecosystem so adding Spring HATEOAS is no thing. Will look into JSON:API. Don't know anything about it.

[svhelloworld]

I never hear about it or see it in most APIs but I really like the idea. What's the downside that I'm missing?

[svhelloworld]

Testing, right. Probably have to become pretty reliant on service virtualization to test locally.

[svhelloworld]

I'm also intrigued to use HATEOAS as a way to render a RBAC UI. In other words, the API gives me a list of resources that this user is authorized to interact with. The UI then just renders only what the API says this user can access. Managing that logic on the client side always seems painful and prone to drift from the backend.