Is it correct to use Post instead of Get to fetch

Question

I am currently creating Restful API through ASP.Net WebAPI technology. I have 2 questions related to WebAPI

I had done below:

1. Created below method in Controller class:

   public HttpResponseMessage PostOrderData(OrderParam OrderInfo)

2. Based on Parameter OrderInfo, Query the SQL Server and get list of orders.
3. Set the Response.Content with the collection object:

List<Orders> ordList = new List<Orders>();  
//filled the ordList from SQL query result  
var response = Request.CreateResponse<List<Orders>>(HttpStatusCode.OK, ordList);

1. On Client side,

OrderParam ordparam = new OrderParam();  
response = client.PostAsJsonAsync("api/order", ordparam).Result;  
if (response.IsSuccessStatusCode)  
{  
List<Orders> mydata = response.Content.ReadAsAsync<List<Orders>>().Result;  
}

So question: is it fine to Post the data to server to Get the data i.e. usage of Post data insted of Get is correct? Is there any disadvantage in approach? (One disadvantage is: I will not able to query directly from browser) I have used Post here because parameter "OrderParam" might extend in future and there might be problem due to increase in Length of URL due to that.

2nd Question is: I have used classes for parameter and for returning objects i.e. OrderParam and Orders. Now consumer (clients) of this web api are different customers and they will consume API through .Net (C#) or through Jquery/JS. So do we need to pass this class file containing defination of OrderParam and Orders classes manually to each client? and send each time to client when there will be any change in above classes?

Thanks in advance
Shah

Answer 1

Typically no.

POST is not safe nor idempotent - as such cannot be cached. It is meant to be used for cases where you are changing the state on the server.

If you have a big critieria, you need to redesign but in most cases, URL fragments or querystring params work. Have a look at OData which uses querystring for very complex queries and uses GET.

With regard to second question, also no. Server can expose schema (similar to WSDL) or docs but should not know about the client.

Answer 2

Yes you can, RESTFUL is nothing to do with Security, it is just a Convention and for Web API you can use it because you do not need any caching for web api.