Bài 4.1: Giới Thiệu Django REST Framework - Phần 1

**Series Navigation:** - **Bài 4.1 (bài này): DRF Introduction & APIView Basics** 👈 - [Bài 4.2: Status Codes, Format Suffixes & Browsable API](/django-advance/django-rest-framework-introduction-phan-2) - [Bài 4.3: Authentication & Permissions](/django-advance/django-rest-framework-introduction-phan-3)

Mục Tiêu Bài 4.1

Sau khi hoàn thành Bài 4.1 này, bạn sẽ:

✅ Hiểu REST principles và best practices
✅ Cài đặt và configure Django REST Framework
✅ Nắm vững APIView basics
✅ Understand Request và Response objects
✅ Implement CRUD operations với APIView
✅ Handle HTTP methods (GET, POST, PUT, PATCH, DELETE)
✅ Build your first RESTful API

Giới Thiệu

What is Django REST Framework?

Django REST Framework (DRF) = Powerful toolkit for building Web APIs trong Django.

Key Features:

🚀 Browsable API (web interface for testing)
🔒 Authentication & Permissions
📦 Serialization (Python ↔ JSON)
🎯 Class-based views (APIView, ViewSets)
📝 Automatic API documentation
⚡ High performance
🔧 Highly customizable

Why DRF?

✅ Industry standard for Django APIs
✅ Battle-tested (Instagram, Mozilla, Red Hat)
✅ Great documentation
✅ Active community
✅ Saves development time

REST API Fundamentals

REST (Representational State Transfer) = Architectural style for designing networked applications.

Core Principles:

1. Resource-Based:

Everything is a resource (user, article, order)
Resources identified by URIs
Example: /api/articles/123/

2. HTTP Methods (CRUD):

GET: Read/retrieve resource
POST: Create new resource
PUT: Update entire resource
PATCH: Partial update
DELETE: Remove resource

3. Stateless:

Each request contains all information needed
Server doesn't store client state
Authentication via tokens, not sessions

4. Uniform Interface:

Consistent URL patterns
Standard HTTP methods
Predictable responses

5. JSON/XML Representations:

Resources represented as JSON (most common)
Client-server communication via JSON

RESTful URL Design

Good URL Patterns:

GET    /api/articles/           # List all articlesPOST   /api/articles/           # Create new articleGET    /api/articles/123/       # Get article #123PUT    /api/articles/123/       # Update article #123 (full)PATCH  /api/articles/123/       # Update article #123 (partial)DELETE /api/articles/123/       # Delete article #123 # Nested resourcesGET    /api/articles/123/comments/     # Comments for article #123POST   /api/articles/123/comments/     # Add comment to article #123 # Filtering, sorting, paginationGET    /api/articles/?status=published&ordering=-created_at&page=2

Bad URL Patterns:

❌ /api/getArticles/❌ /api/article/delete/123/❌ /api/createNewArticle/❌ /api/articles/get_by_id?id=123

Best Practices:

✅ Use nouns, not verbs (resources, not actions)
✅ Plural for collections (/articles/ not /article/)
✅ Use HTTP methods for actions
✅ Versioning: /api/v1/articles/
✅ Use hyphens for readability: /blog-posts/

HTTP Status Codes Quick Reference

Success (2xx):

200 OK - Request successful
201 Created - Resource created
204 No Content - Success, no response body

Client Errors (4xx):

400 Bad Request - Invalid request data
401 Unauthorized - Authentication required
403 Forbidden - No permission
404 Not Found - Resource doesn't exist

Server Errors (5xx):

500 Internal Server Error - Server problem

DRF Installation & Setup

Installation

Install DRF:

pip install djangorestframework

Verify Version:

pip show djangorestframework

Configuration

1. Add to INSTALLED_APPS (settings.py):

INSTALLED_APPS = [    'django.contrib.admin',    'django.contrib.auth',    'django.contrib.contenttypes',    'django.contrib.sessions',    'django.contrib.messages',    'django.contrib.staticfiles',        # Third-party apps    'rest_framework',  # ✅ Add this        # Your apps    'myapp',]

2. Basic DRF Settings:

# settings.pyREST_FRAMEWORK = {    # Pagination    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',    'PAGE_SIZE': 10,        # Default permissions (covered in Part 3)    'DEFAULT_PERMISSION_CLASSES': [        'rest_framework.permissions.AllowAny',    ],        # Renderers    'DEFAULT_RENDERER_CLASSES': [        'rest_framework.renderers.JSONRenderer',        'rest_framework.renderers.BrowsableAPIRenderer',    ],}

3. URL Configuration:

# project/urls.pyfrom django.contrib import adminfrom django.urls import path, include urlpatterns = [    path('admin/', admin.site.urls),    path('api/', include('myapp.urls')),  # Your API URLs]

Project Structure

Recommended Structure:

myproject/├── myapp/│   ├── migrations/│   ├── __init__.py│   ├── models.py│   ├── serializers.py      # ✅ New: API serializers│   ├── views.py             # API views│   ├── urls.py              # API URL patterns│   └── tests.py├── myproject/│   ├── settings.py│   └── urls.py└── manage.py

APIView Basics

What is APIView?

APIView = Base class for building API views in DRF.

Features:

Request/Response objects (not Django's HttpRequest)
Automatic content negotiation (JSON/XML)
Authentication & permissions
Exception handling
Throttling support

Basic APIView Pattern

Simple Example:

# views.pyfrom rest_framework.views import APIViewfrom rest_framework.response import Responsefrom rest_framework import status class HelloWorldView(APIView):    """Simple Hello World API"""        def get(self, request):        data = {            'message': 'Hello, World!',            'method': 'GET'        }        return Response(data)        def post(self, request):        name = request.data.get('name', 'Guest')        data = {            'message': f'Hello, {name}!',            'method': 'POST'        }        return Response(data, status=status.HTTP_201_CREATED)

URL Configuration:

# urls.pyfrom django.urls import pathfrom .views import HelloWorldView urlpatterns = [    path('hello/', HelloWorldView.as_view(), name='hello'),]

Testing:

# GET requestcurl http://localhost:8000/api/hello/ # POST requestcurl -X POST http://localhost:8000/api/hello/ \  -H "Content-Type: application/json" \  -d '{"name": "John"}'

Request Object

DRF Request extends Django's HttpRequest with:

1. request.data:

# Access POST/PUT/PATCH data (replaces request.POST)def post(self, request):    username = request.data.get('username')    email = request.data.get('email')    # Works with JSON, form data, multipart

2. request.query_params:

# Access query string parameters (replaces request.GET)def get(self, request):    page = request.query_params.get('page', 1)    status = request.query_params.get('status', 'all')    # /api/articles/?page=2&status=published

3. request.user:

# Current authenticated userdef get(self, request):    if request.user.is_authenticated:        return Response({'username': request.user.username})

4. request.auth:

# Authentication credentials (token, JWT, etc.)def get(self, request):    token = request.auth  # Token object if authenticated

5. request.method:

# HTTP method: GET, POST, PUT, PATCH, DELETEdef get(self, request):    return Response({'method': request.method})

Response Object

DRF Response features:

1. Automatic Content Negotiation:

# Automatically converts to JSON, XML, etc.return Response({'message': 'Hello'})# Content-Type: application/json

2. Status Codes:

from rest_framework import status # Successreturn Response(data, status=status.HTTP_200_OK)return Response(data, status=status.HTTP_201_CREATED) # Client errorsreturn Response(errors, status=status.HTTP_400_BAD_REQUEST)return Response({'error': 'Not found'}, status=status.HTTP_404_NOT_FOUND)

3. Custom Headers:

return Response(    data,    status=status.HTTP_201_CREATED,    headers={'Location': '/api/articles/123/'})

Building CRUD API with APIView

Example Model

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class Article(models.Model):    STATUS_CHOICES = [        ('draft', 'Draft'),        ('published', 'Published'),    ]        title = models.CharField(max_length=200)    content = models.TextField()    status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='draft')    author = models.ForeignKey(User, on_delete=models.CASCADE, related_name='articles')    created_at = models.DateTimeField(auto_now_add=True)    updated_at = models.DateTimeField(auto_now=True)        class Meta:        ordering = ['-created_at']        def __str__(self):        return self.title

Simple Serializer

# serializers.pyfrom rest_framework import serializersfrom .models import Article class ArticleSerializer(serializers.ModelSerializer):    author_username = serializers.CharField(source='author.username', read_only=True)        class Meta:        model = Article        fields = ['id', 'title', 'content', 'status', 'author', 'author_username',                   'created_at', 'updated_at']        read_only_fields = ['id', 'created_at', 'updated_at']

List & Create View

# views.pyfrom rest_framework.views import APIViewfrom rest_framework.response import Responsefrom rest_framework import statusfrom .models import Articlefrom .serializers import ArticleSerializer class ArticleListView(APIView):    """    GET: List all articles    POST: Create new article    """        def get(self, request):        """List all articles"""        articles = Article.objects.all()        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)        def post(self, request):        """Create new article"""        serializer = ArticleSerializer(data=request.data)                if serializer.is_valid():            serializer.save(author=request.user)            return Response(serializer.data, status=status.HTTP_201_CREATED)                return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Key Points:

many=True for querysets (multiple objects)
serializer.is_valid() validates data
serializer.save() creates model instance
Pass extra data to save() (like author=request.user)

Retrieve, Update, Delete View

class ArticleDetailView(APIView):    """    GET: Retrieve single article    PUT: Update entire article    PATCH: Partial update    DELETE: Delete article    """        def get_object(self, pk):        """Helper method to get article or 404"""        try:            return Article.objects.get(pk=pk)        except Article.DoesNotExist:            return None        def get(self, request, pk):        """Retrieve single article"""        article = self.get_object(pk)        if article is None:            return Response(                {'error': 'Article not found'},                status=status.HTTP_404_NOT_FOUND            )                serializer = ArticleSerializer(article)        return Response(serializer.data)        def put(self, request, pk):        """Update entire article"""        article = self.get_object(pk)        if article is None:            return Response(                {'error': 'Article not found'},                status=status.HTTP_404_NOT_FOUND            )                serializer = ArticleSerializer(article, data=request.data)        if serializer.is_valid():            serializer.save()            return Response(serializer.data)                return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)        def patch(self, request, pk):        """Partial update"""        article = self.get_object(pk)        if article is None:            return Response(                {'error': 'Article not found'},                status=status.HTTP_404_NOT_FOUND            )                serializer = ArticleSerializer(article, data=request.data, partial=True)        if serializer.is_valid():            serializer.save()            return Response(serializer.data)                return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)        def delete(self, request, pk):        """Delete article"""        article = self.get_object(pk)        if article is None:            return Response(                {'error': 'Article not found'},                status=status.HTTP_404_NOT_FOUND            )                article.delete()        return Response(status=status.HTTP_204_NO_CONTENT)

Key Differences:

PUT: All fields required (full update)
PATCH: partial=True allows partial update
DELETE: Return 204 No Content (no body)

URL Configuration

# urls.pyfrom django.urls import pathfrom .views import ArticleListView, ArticleDetailView app_name = 'api' urlpatterns = [    path('articles/', ArticleListView.as_view(), name='article-list'),    path('articles/<int:pk>/', ArticleDetailView.as_view(), name='article-detail'),]

URL Patterns:

GET    /api/articles/           → ArticleListView.get()POST   /api/articles/           → ArticleListView.post()GET    /api/articles/123/       → ArticleDetailView.get(pk=123)PUT    /api/articles/123/       → ArticleDetailView.put(pk=123)PATCH  /api/articles/123/       → ArticleDetailView.patch(pk=123)DELETE /api/articles/123/       → ArticleDetailView.delete(pk=123)

Query Parameters & Filtering

Basic Filtering

class ArticleListView(APIView):    def get(self, request):        articles = Article.objects.all()                # Filter by status        status_filter = request.query_params.get('status')        if status_filter:            articles = articles.filter(status=status_filter)                # Filter by author        author_id = request.query_params.get('author')        if author_id:            articles = articles.filter(author_id=author_id)                # Search by title        search = request.query_params.get('search')        if search:            articles = articles.filter(title__icontains=search)                serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

Usage:

# Filter published articlesGET /api/articles/?status=published # Filter by authorGET /api/articles/?author=5 # Search by titleGET /api/articles/?search=django # Combine filtersGET /api/articles/?status=published&author=5&search=django

Ordering

class ArticleListView(APIView):    def get(self, request):        articles = Article.objects.all()                # Ordering        ordering = request.query_params.get('ordering', '-created_at')        articles = articles.order_by(ordering)                serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

Usage:

# Order by title (ascending)GET /api/articles/?ordering=title # Order by created_at (descending)GET /api/articles/?ordering=-created_at

Pagination (Manual)

class ArticleListView(APIView):    def get(self, request):        articles = Article.objects.all()                # Pagination        page = int(request.query_params.get('page', 1))        page_size = int(request.query_params.get('page_size', 10))                start = (page - 1) * page_size        end = start + page_size                paginated_articles = articles[start:end]        serializer = ArticleSerializer(paginated_articles, many=True)                return Response({            'count': articles.count(),            'page': page,            'page_size': page_size,            'results': serializer.data        })

Usage:

# Get page 2 with 20 itemsGET /api/articles/?page=2&page_size=20

Error Handling

ValidationError

from rest_framework.exceptions import ValidationError class ArticleListView(APIView):    def post(self, request):        serializer = ArticleSerializer(data=request.data)                if serializer.is_valid():            # Additional validation            if len(request.data.get('title', '')) < 10:                raise ValidationError({                    'title': 'Title must be at least 10 characters'                })                        serializer.save(author=request.user)            return Response(serializer.data, status=status.HTTP_201_CREATED)                return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

NotFound Exception

from rest_framework.exceptions import NotFound class ArticleDetailView(APIView):    def get_object(self, pk):        try:            return Article.objects.get(pk=pk)        except Article.DoesNotExist:            raise NotFound(detail='Article not found')        def get(self, request, pk):        article = self.get_object(pk)  # Auto-raises NotFound        serializer = ArticleSerializer(article)        return Response(serializer.data)

PermissionDenied

from rest_framework.exceptions import PermissionDenied class ArticleDetailView(APIView):    def delete(self, request, pk):        article = self.get_object(pk)                # Only author can delete        if article.author != request.user:            raise PermissionDenied(detail='Only author can delete this article')                article.delete()        return Response(status=status.HTTP_204_NO_CONTENT)

Tóm Tắt Bài 4.1

Trong Bài 4.1 này, bạn đã học:

✅ REST API Fundamentals:

REST principles: resource-based, HTTP methods, stateless
RESTful URL design patterns
HTTP status codes (2xx, 4xx, 5xx)

✅ DRF Setup:

Installation với pip
Configuration trong settings.py
Project structure

✅ APIView Basics:

APIView class structure
Request object (data, query_params, user, method)
Response object (status codes, headers)

✅ CRUD Operations:

List & Create (GET, POST)
Retrieve, Update, Delete (GET, PUT, PATCH, DELETE)
Serializer usage (many=True, is_valid(), save())

✅ Advanced Features:

Query parameters & filtering
Ordering & sorting
Manual pagination
Error handling (ValidationError, NotFound, PermissionDenied)

Exercises

Exercise 1: Book API

Model:

class Book(models.Model):    title = models.CharField(max_length=200)    author = models.CharField(max_length=100)    isbn = models.CharField(max_length=13, unique=True)    published_date = models.DateField()    pages = models.IntegerField()    price = models.DecimalField(max_digits=6, decimal_places=2)

Tasks:

Create BookSerializer
Implement BookListView (GET, POST)
Implement BookDetailView (GET, PUT, PATCH, DELETE)
Add filtering by author and price range
Add search by title (icontains)
Validate: pages > 0, price > 0, ISBN format

Exercise 2: Comment System

Models:

class Post(models.Model):    title = models.CharField(max_length=200)    content = models.TextField()    author = models.ForeignKey(User, related_name='posts') class Comment(models.Model):    post = models.ForeignKey(Post, related_name='comments')    author = models.ForeignKey(User, related_name='comments')    text = models.TextField()    created_at = models.DateTimeField(auto_now_add=True)

Tasks:

Create serializers for Post and Comment
Implement nested route: /api/posts/<id>/comments/
GET: List comments for a post
POST: Add comment to post
DELETE: Delete own comment only
Add pagination (10 comments per page)

Exercise 3: Product Inventory

Model:

class Product(models.Model):    name = models.CharField(max_length=200)    sku = models.CharField(max_length=50, unique=True)    price = models.DecimalField(max_digits=10, decimal_places=2)    stock = models.IntegerField(default=0)    is_active = models.BooleanField(default=True)

Tasks:

Create ProductSerializer with computed field in_stock (stock > 0)
Implement CRUD views
Add custom action: PATCH /api/products/<id>/adjust_stock/
- Accept {"quantity": 10} to add/subtract stock
Add filtering: ?is_active=true&min_price=10&max_price=100
Add ordering: ?ordering=price or ?ordering=-price
Validate: price >= 0, stock >= 0

Next Steps

Trong Bài 4.2, bạn sẽ học:

Status codes best practices
Format suffixes (.json, .api)
Browsable API features
Content negotiation
Custom renderers
API testing với curl và Postman

Navigation:

← Bài 3.4: Aggregation & Annotation
Bài 4.1: DRF Introduction & APIView (current)
Bài 4.2: Status Codes & Browsable API →

#apiview

Giới Thiệu Django REST Framework - Phần 1