title: REST API Design - DELETE multiple items using request Body
body: <p>I have an API that displays Supplier Products</p>
  
  <p>Our UI will allow the user to select various filter criteria and use that to delete a number of products at once.</p>
  
  <p>The problem is that it takes too long do do a few thousand individual HTTP delete requests:</p>
  
  <pre><code>DELETE /api/supplier/6/products/5
  DELETE /api/supplier/6/products/7
  DELETE /api/supplier/6/products/8
  DELETE /api/supplier/6/products/10
  ...
  </code></pre>
  
  <p>The intention is to make one HTTP call to delete a bunch of supplier products at once.  I can pass a body to the delete so that it contains a list of all the ID's that we would like to delete:</p>
  
  <pre><code>DELETE /api/supplier/6/products
  Body:
  {
    "DeleteIds": "[5,7,8,10]"
  }
  </code></pre>
  
  <p>This worked well until we put it behind our production proxy firewall which stripped the body from the DELETE request.</p>
  
  <p>I have had a look at the HTTP Spec  <a href="https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html" rel="nofollow noreferrer">RFC 2616 Fielding, et al.</a> and it doesn't explicity state that I shouldn't use a body in a DELETE request and further reading has shown that there isn't anything wrong with sending a body with a DELETE request. </p>
  
  <p>I have control over our proxy server and have been able to allow the body to be passed through for all requests, but I worry that this may not be best practise.  We could have thousands of Id's that we pass through and I don't want to us headers or URL parameters as we could run up against length restrictions.</p>
  
  <p><strong>So my question is:</strong>
  What would be the correct way to do a Delete for multiple products <strong>using the body of a request</strong>?  Not just an opinion, but is there actual documented evidence out there for as to why I should not use the body of a HTTP DELETE?</p>
  
  <p>Should I continue with </p>
  
  <pre><code>DELETE /api/supplier/6/products (Using a body)
  </code></pre>
  
  <p>or should not use DELETE with a body and instead do a POST to something like</p>
  
  <pre><code>POST /api/supplier/6/products/deletemultiple
  </code></pre>
  
  <p>Edit:
  There is some good debate in this question: <a href="https://stackoverflow.com/questions/2421595/restful-way-for-deleting-a-bunch-of-items">Restful way for deleting a bunch of items</a>
  It doesn't address my question about using the body of a DELETE request for a custom delete action, but there is some good debate on different ways that a batch delete can happen.</p>