DependencyTrack / DependencyTrack/dependency-track

REST API does not conform with HTTP spec

Open
#2,553 3 comments 0 reactions 0 assignees View on GitHub
defect p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

REST API method usage does not conform to HTTP specifications https://www.rfc-editor.org/rfc/rfc9110

Some examples:

| Method | RFC / best practices | this API | Hint |
|---|---|---|---|
| PUT | replaces a resource with the request payload, e.g /project/{project-id} | create a resource | move PUT operation under POST |
| PATCH | use a specific media type (e.g. merge-patch+json) | use application/json | enforce merge-patch+json |
| POST | used to create resources, returns the Location header | used to update a resource but points to the parent | when uuid is not present, should create the resource |

If you are interested, I can provide further feedback.

### Steps to Reproduce

## e.g. POST updates a project

```python
requests.post(
"http://localhost:8081/api/v1/project",
data={"name": "foo", "description": "bar", "classifier":"APPLICATION"}
headers={"X-API-Key": SBOM_TOKEN, "Content-Type": "application/json"},
)
b'The UUID of the project could not be found.'

```

### Expected Behavior

## POST creates a project when uuid is not provided

### Dependency-Track Version

4.6.x

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.