Skip to content
Sarj Code Standards

no-work-verb-get-route

GET routes must not end in a work verb such as run, send, trigger or retry.

SARJ502 Rule source Tests Catalog JSON

Why

GET must be safe. A GET that dispatches work can be fired cross-site by an image tag or link prefetch, bypasses CSRF protection, and is retried freely by proxies and clients.

Fix

Change the operation to POST and keep GET for reads.

Examples

Before — flagged A GET route retries a batch
api.py
from fastapi import APIRouter


router = APIRouter()




@router.get("/batches/{batch_id}/retry")
async def retry(batch_id: str) -> None:
    return None
After — preferred The retry is a POST
api.py
from fastapi import APIRouter


router = APIRouter()




@router.post("/batches/{batch_id}/retry")
async def retry(batch_id: str) -> None:
    return None