title: REST API design of a resource whose properties are not editable by the client
body: <p>What's the best way to handle resource properties which must be modified/updated through another method that is not exposed to the API consumer?</p>
  
  <p>Examples:</p>
  
  <ol>
  <li><p>Requesting a new token to used for X. The token must be generated following a specific set of business rules/logic. </p></li>
  <li><p>Requesting/refreshing the exchange rate of a currency after the old rate expires. The rate is for informational purposes and will be used in subsequent transactions.</p></li>
  </ol>
  
  <p>Note that in the above two examples, the values are properties of a resource and not separate resources on their owns.</p>
  
  <p>What's the best way to handle these types of scenarios and other scenarios where the API consumer doesn't have control of the value of the property, but needs to request a new one. One option would be to allow a <code>PATCH</code> with that specific property in the request body but not actually update the property to the value specified, instead, run the necessary logic to update the property and return the updated resource.</p>
  
  <p>Lets look at #1 in more detail:</p>
  
  <p><strong>Request</strong>:</p>
  
  <pre><code>GET /User/1
  </code></pre>
  
  <p><strong>Response</strong>:</p>
  
  <pre><code>{
     "Id": 1,
     "Email": "myemail@gmail.com",
     "SpecialToken": "12345689"
  }
  </code></pre>
  
  <p>As the consumer of the API, I want to be able to request a new <code>SpecialToken</code>, but the business rules to generate the token are not visible to me.</p>
  
  <p>How do I tell the API that I need a new/refreshed <code>SpecialToken</code> with in the REST paradigm?</p>
  
  <p>One thought would be to do:</p>
  
  <p><strong>Request</strong>:</p>
  
  <pre><code>PATCH /User/1
  {
     "SpecialToken": null
  }
  </code></pre>
  
  <p>The server would see this request and know that it needs to refresh the token. The backend will update the <code>SpecialToken</code> with a specific algorithm and return the updated resource:</p>
  
  <p><strong>Response</strong>:</p>
  
  <pre><code>{
     "Id": 1,
     "Email": "myemail@gmail.com",
     "SpecialToken": "99999999"
  }
  </code></pre>
  
  <p>This example can be extended to example #2 where <code>SpecialToken</code> is an exchange rate on resource <code>CurrencyTrade</code>. <code>ExchangeRate</code> is a read only value that the consumer of the API can't change directly, but can request for it to be changed/refreshed:</p>
  
  <p><strong>Request</strong>:</p>
  
  <pre><code>GET /CurrencyTrade/1
  </code></pre>
  
  <p><strong>Response</strong>:</p>
  
  <pre><code>{
     "Id": 1,
     "PropertyOne": "Value1",
     "PropertyTwo": "Value2",
     "ExchangeRate":  1.2
  }
  </code></pre>
  
  <p>Someone consuming the API would need a way to request a new ExchangeRate, but they don't have control of what the value will be, it's strictly a <code>read only property</code>.</p>