spring-boot-rest-api-standards

Create a @RestController class with @RequestMapping for the base path, then use @GetMapping, @PostMapping, @PutMapping, and @DeleteMapping for operations. Return ResponseEntity with appropriate status codes like 201 for creation and 204 for deletion.

Add @Valid to the @RequestBody parameter and annotate DTO fields with Jakarta constraints like @NotBlank, @Email, and @Size. Handle MethodArgumentNotValidException in a @RestControllerAdvice to return standardized 400 error responses.

No, always use separate request and response DTOs to decouple API contracts from domain entities. This prevents leaking internal fields, avoids lazy-loading serialization issues, and lets the API evolve independently of the database schema.

Accept page and size request parameters, build a Pageable with PageRequest.of(page, size, sort), and return a Page<T> from the repository. Include metadata like totalElements and totalPages, and cap the maximum page size to prevent abuse.

Return 200 for successful reads and updates, 201 with a Location header for creation, 204 for deletes, 400 for validation failures, 404 for missing resources, and 409 for conflicts such as duplicate emails. Handle errors globally with @RestControllerAdvice.

Define a SecurityFilterChain bean that configures a CorsConfigurationSource with allowed origins, methods, and headers. Add security headers including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options through the headers DSL.