I need help for creating the REST endpoints. There are couple of activities :

To change the email there are 3 URL requests required:

1. /changeemail : Here one time password (OTP) is sent to the user's mobile
2. /users/email : the user sends the one time password from previous step and system sends the email to the new user to click on the email activate link
3. /activateemail : user clicks on the link in the new email inbox and server updates the new email

To change password :

1. /users/password (PATCH) : user submits old password and new password and system accordingly updates the new password

Similarly, there are other endpoints to change profile (field include bday, firstname and last name)

after reading online I believe my system as only `users` as the resource --> so to update the attributes I was thinking of using a single PATCH for change email and change password and along with that something like operation field so the above two features will look like :

For changing email :

1. operation : 'sendOTPForEmailChange'
2. operation : 'sendEmailActivationLink'
3. operation : 'activateEmail'

For changing password :

1. operation : 'changePassword'

and I will have only one endpoint for all the above operations that is (in nodejs) :

```
app.patch('/users', function (req, res) {
  // depending upon the operation I delegate it to the respective method
   if (req.body.operation === 'sendOTPForEmailChange') {
       callMethodA();
   } else if (req.body.operation === 'sendEmailActivationLink') {
     callMethodB();
   } else if (req.body.operation === 'activateEmail') {
      callMethodC();
   } else if (req.body.operation === 'changePassword') {
      callMethodC();
   } else sendReplyError();

});

```

Does this sound a good idea ? If not, someone can help me form the endpoints for changeemail and changepassword.

**Answer** :

I finally settled for using PATCH with operation field in the HTTP Request Body to indicate what operation has to be performed.
Since I was only modifying a single field of the resource I used the PATCH method.
Also, I wanted to avoid using Verbs in the URI so using 'operation' field looked better.

Some references I used in making this decision :

Wilts answer [link here](https://stackoverflow.com/questions/3077229/restful-password-reset/33389526?noredirect=1#comment77332886_33389526)

Mark Nottingham' blog [link article](https://www.mnot.net/blog/2012/09/05/patch)

and finally JSON MERGE PATCH [link RFC](https://www.rfc-editor.org/rfc/rfc7386)