Annotate REST API Actions with HTTP Verb Attributes

Why this matters

Without explicit HTTP method attributes, API behavior can be unclear, leading to route conflicts and unexpected results.

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

[Route("Customer")]                                                        // This route conflicts with GetCustomers action route
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)   // Noncompliant
{
    // ...
    return Results.Ok();
}

[Route("Customer")]                         // This route conflicts with ChangeCustomer action route
public async Task<string> GetCustomers()    // Noncompliant
{
    return _customerRepository.GetAll();
}

Prefer

[Route("Customer")]
[HttpPost]
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)    // Compliant
{
    // ...
    return Results.Ok();
}

[HttpGet("Customer")]
public async Task<string> GetCustomers()    // Compliant
{
    return _customerRepository.GetAll();
}

More snippets

Bad

[Route("Customer")]                                                        // This route conflicts with GetCustomers action route
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)   // Noncompliant
{
    // ...
    return Results.Ok();
}

[Route("Customer")]                         // This route conflicts with ChangeCustomer action route
public async Task<string> GetCustomers()    // Noncompliant
{
    return _customerRepository.GetAll();
}

Good

[Route("Customer")]
[HttpPost]
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)    // Compliant
{
    // ...
    return Results.Ok();
}

[HttpGet("Customer")]
public async Task<string> GetCustomers()    // Compliant
{
    return _customerRepository.GetAll();
}

Related rules

From the same buckets as this rule.

Critical

Check consent and role-based authorization before returning ePHI

Handlers must verify the requester’s role and a valid consent/relationship (e.g., care team assignment) before disclosing ePHI; include Purpose-Of-Use in the decision and audit the outcome.

compliance-hipaasecurity-hardening+2

Critical

Children's data: verify age and parental consent

If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.

compliance-lgpdapi-conventions+1

Critical

Disallow public ingress without explicit allowlist

For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.

infra-as-codesecurity-hardening+1

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

[Route("Customer")]                                                        // This route conflicts with GetCustomers action route
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)   // Noncompliant
{
    // ...
    return Results.Ok();
}

[Route("Customer")]                         // This route conflicts with ChangeCustomer action route
public async Task<string> GetCustomers()    // Noncompliant
{
    return _customerRepository.GetAll();
}

Prefer

[Route("Customer")]
[HttpPost]
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)    // Compliant
{
    // ...
    return Results.Ok();
}

[HttpGet("Customer")]
public async Task<string> GetCustomers()    // Compliant
{
    return _customerRepository.GetAll();
}

More snippets

Bad

[Route("Customer")]                                                        // This route conflicts with GetCustomers action route
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)   // Noncompliant
{
    // ...
    return Results.Ok();
}

[Route("Customer")]                         // This route conflicts with ChangeCustomer action route
public async Task<string> GetCustomers()    // Noncompliant
{
    return _customerRepository.GetAll();
}

Good

[Route("Customer")]
[HttpPost]
public async Task<IResult> ChangeCustomer([FromBody] CustomerData data)    // Compliant
{
    // ...
    return Results.Ok();
}

[HttpGet("Customer")]
public async Task<string> GetCustomers()    // Compliant
{
    return _customerRepository.GetAll();
}

Related rules

From the same buckets as this rule.

Critical

Check consent and role-based authorization before returning ePHI

Handlers must verify the requester’s role and a valid consent/relationship (e.g., care team assignment) before disclosing ePHI; include Purpose-Of-Use in the decision and audit the outcome.

compliance-hipaasecurity-hardening+2

Critical

Children's data: verify age and parental consent

If data subject is a child/adolescent, require age verification and parental/legal guardian consent prior to processing; deny processing otherwise and do not store the payload.

compliance-lgpdapi-conventions+1

Critical

Disallow public ingress without explicit allowlist

For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.

infra-as-codesecurity-hardening+1