Q: How to properly write API-s I have a table called scores and that has two fields: team_id and score_value. 
I need to insert records into this table using HTTP call like scores/teams/{team_id} (POST). 
public function($team_id,$score){
 $scores = new Scores();
 $scores->team_id = $team_id;
 $scores->score_value = $score;
 $scores->save();
}

I could do the same with scores/teams (POST), so I don't really need to pass the team_id as an parameter since I can get that field inside insertion function like below:
public function($score){
 $scores = new Scores();
 $scores->team_id = Auth->user->team_id; (logged in user team id)
 $scores->score_value = $score;
 $scores->save();
}

Which one of these two options would be the best option to have and of course more flexible? 
If I choose to have the second option, I should pass the team_id from the front end always, would that be safe? I mean is it safe to store the team_id of user into localStorage or how do you deal with this case?

A: First of all, I hope, in both scenarios, a user is authorised to update the scores, otherwise anyone can mess up with your data.
Personally, I would prefer the second scenario, as you POST to unknown location (the app decides which team_id to use, based on the auth data).
In the first scenario, I'd use PUT instead, you can read more about PUT vs POST here http://restcookbook.com/HTTP%20Methods/put-vs-post/
I also think the second option is more flexible and requires less security checks, as you don't have to compare received team_id against logged in user team id.
