Many resources have a lifecycle: an order is placed, paid, shipped and delivered; a launch is scheduled, scrubbed or flown. Modelling it as a state machine means listing the states and the transitions allowed between them, and refusing everything else — you cannot ship an order that was never paid, or cancel one that was delivered.
Transitions are usually exposed as actions — POST /orders/7/cancel — or as an update to a status field that the server validates. An illegal transition answers 409 Conflict, because the request is well-formed but conflicts with the resource's current state. HATEOAS-style responses can include only the links for transitions that are currently legal.
That status is just another field. A client that sets status freely through a generic PUT can skip states the business depends on — refunds without cancellations, deliveries without shipments. The transitions, not the field, are the contract.
The Cargo Tracking API is a full state machine: POST /cargo/v1/shipments/{id}/advance moves a parcel one step and answers 409 at the end of the line, and three failed delivery attempts return it to sender.
All glossary terms · Testing techniques · All 39 mock REST APIs
Last updated