Web API controllers

Web API controllers return JSON (or XML) instead of HTML views. They power SPAs, mobile apps, and microservices—RESTful routes with HTTP verbs and status codes.

ApiController basics

[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase {
    [HttpGet]
    public async Task<ActionResult<List<ProductDto>>> List() { }

    [HttpGet("{id:int}")]
    public async Task<ActionResult<ProductDto>> Get(int id) { }

    [HttpPost]
    public async Task<ActionResult<ProductDto>> Create(ProductCreateDto dto) { }
}

Status codes

• 200 OK — success with body
• 201 Created — use CreatedAtAction
• 400 Bad Request — validation failures
• 404 Not Found — missing resource
• 204 No Content — successful DELETE

[ApiController] behaviors

Automatic model validation (400 on invalid ModelState), binding source inference, and problem details for errors.

Important interview questions and answers

1. Q: REST vs RPC-style routes?
   A: REST uses nouns and HTTP verbs; RPC uses action names in URLs—pick consistency for your API consumers.
2. Q: DTO vs entity in API?
   A: Never expose EF entities directly—DTOs control shape and prevent over-posting/leaky relations.

Self-check

1. Which attribute enables automatic 400 on invalid models?
2. What status code fits a successful POST that creates a resource?

Tip: Return DTOs from APIs, not EF entities—prevents leaking navigation graphs and protects against over-posting on write endpoints.