Bài 4.2: Status Codes, Format Suffixes & Browsable API - Phần 2

**Series Navigation:** - [Bài 4.1: DRF Introduction & APIView Basics](/django-advance/django-rest-framework-introduction-phan-1) - **Bài 4.2 (bài này): Status Codes, Format Suffixes & Browsable API** 👈 - [Bài 4.3: Authentication & Permissions](/django-advance/django-rest-framework-introduction-phan-3)

Mục Tiêu Bài 4.2

Sau khi hoàn thành Bài 4.2 này, bạn sẽ:

✅ Master HTTP Status Codes và best practices
✅ Implement Format Suffixes (.json, .api)
✅ Customize Browsable API interface
✅ Understand Content Negotiation
✅ Work với Custom Renderers
✅ Test APIs với curl, HTTPie và Postman
✅ Handle multiple response formats (JSON, XML, CSV)

HTTP Status Codes Deep Dive

Why Status Codes Matter

Status codes = Language để API communicate results với clients.

Benefits:

🎯 Precise error communication
🤖 Machine-readable responses
📊 Better monitoring & logging
🔧 Easier debugging
📱 Better client experience

Complete Status Code Reference

Success Responses (2xx)

200 OK:

Use Case: Successful GET, PUT, PATCH
Has Body: Yes (resource data)

# GET single resourcedef get(self, request, pk):    article = self.get_object(pk)    serializer = ArticleSerializer(article)    return Response(serializer.data, status=status.HTTP_200_OK) # PUT updatedef put(self, request, pk):    article = self.get_object(pk)    serializer = ArticleSerializer(article, data=request.data)    if serializer.is_valid():        serializer.save()        return Response(serializer.data)  # Default is 200    return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

201 Created:

Use Case: Successful POST (resource created)
Has Body: Yes (new resource)
Header: Location header with new resource URL

def post(self, request):    serializer = ArticleSerializer(data=request.data)    if serializer.is_valid():        article = serializer.save(author=request.user)                # Include Location header        headers = {            'Location': f'/api/articles/{article.id}/'        }                return Response(            serializer.data,            status=status.HTTP_201_CREATED,            headers=headers        )    return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

202 Accepted:

Use Case: Request accepted for async processing
Has Body: Optional (processing info)

from celery import shared_task @shared_taskdef process_bulk_import(file_id):    # Heavy processing    pass class BulkImportView(APIView):    def post(self, request):        file_id = request.data.get('file_id')                # Start async task        task = process_bulk_import.delay(file_id)                return Response(            {                'message': 'Import started',                'task_id': task.id,                'status_url': f'/api/tasks/{task.id}/'            },            status=status.HTTP_202_ACCEPTED        )

204 No Content:

Use Case: Successful DELETE, or update with no body
Has Body: No (empty response)

def delete(self, request, pk):    article = self.get_object(pk)    article.delete()    # No body needed    return Response(status=status.HTTP_204_NO_CONTENT) # Also useful for PATCH when no data neededdef patch(self, request, pk):    article = self.get_object(pk)    article.mark_as_read()    return Response(status=status.HTTP_204_NO_CONTENT)

Client Error Responses (4xx)

400 Bad Request:

Use Case: Invalid request data, validation errors
Has Body: Yes (error details)

def post(self, request):    serializer = ArticleSerializer(data=request.data)        if not serializer.is_valid():        return Response(            {                'error': 'Validation failed',                'details': serializer.errors            },            status=status.HTTP_400_BAD_REQUEST        )        serializer.save()    return Response(serializer.data, status=status.HTTP_201_CREATED)

Response Example:

{    "error": "Validation failed",    "details": {        "title": ["This field is required."],        "content": ["Ensure this field has at least 100 characters."]    }}

401 Unauthorized:

Use Case: Authentication required but not provided
Has Body: Yes (authentication hint)
Header: WWW-Authenticate

from rest_framework.exceptions import AuthenticationFailed class ProtectedView(APIView):    def get(self, request):        if not request.user.is_authenticated:            return Response(                {                    'error': 'Authentication required',                    'message': 'Please provide valid credentials'                },                status=status.HTTP_401_UNAUTHORIZED,                headers={'WWW-Authenticate': 'Token'}            )                return Response({'data': 'Protected content'})

403 Forbidden:

Use Case: Authenticated but no permission
Has Body: Yes (permission error)

from rest_framework.exceptions import PermissionDenied class ArticleDetailView(APIView):    def delete(self, request, pk):        article = self.get_object(pk)                # Check permission        if article.author != request.user and not request.user.is_staff:            return Response(                {                    'error': 'Permission denied',                    'message': 'Only author or staff can delete this article'                },                status=status.HTTP_403_FORBIDDEN            )                article.delete()        return Response(status=status.HTTP_204_NO_CONTENT)

404 Not Found:

Use Case: Resource doesn't exist
Has Body: Yes (error message)

from rest_framework.exceptions import NotFound class ArticleDetailView(APIView):    def get_object(self, pk):        try:            return Article.objects.get(pk=pk)        except Article.DoesNotExist:            raise NotFound(detail='Article not found')        def get(self, request, pk):        article = self.get_object(pk)  # Auto-raises 404        serializer = ArticleSerializer(article)        return Response(serializer.data) # Or manual handlingdef get_alternative(self, request, pk):    try:        article = Article.objects.get(pk=pk)    except Article.DoesNotExist:        return Response(            {'error': f'Article with id {pk} does not exist'},            status=status.HTTP_404_NOT_FOUND        )        serializer = ArticleSerializer(article)    return Response(serializer.data)

405 Method Not Allowed:

Use Case: HTTP method not supported
Has Body: Yes (allowed methods)
Automatically handled by DRF

class ArticleListView(APIView):    # Only GET and POST allowed    def get(self, request):        pass        def post(self, request):        pass        # PUT, PATCH, DELETE → 405 automatically

Response (automatic):

{    "detail": "Method \"PUT\" not allowed."}

409 Conflict:

Use Case: Resource conflict (duplicate, version conflict)
Has Body: Yes (conflict details)

from rest_framework.exceptions import ValidationError def post(self, request):    email = request.data.get('email')        # Check if user exists    if User.objects.filter(email=email).exists():        return Response(            {                'error': 'Conflict',                'message': f'User with email {email} already exists',                'field': 'email'            },            status=status.HTTP_409_CONFLICT        )        # Create user    serializer = UserSerializer(data=request.data)    if serializer.is_valid():        serializer.save()        return Response(serializer.data, status=status.HTTP_201_CREATED)        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

422 Unprocessable Entity:

Use Case: Semantic validation errors
Has Body: Yes (validation errors)

def post(self, request):    serializer = OrderSerializer(data=request.data)        if serializer.is_valid():        # Business logic validation        product = Product.objects.get(pk=request.data['product_id'])        quantity = request.data['quantity']                if product.stock < quantity:            return Response(                {                    'error': 'Insufficient stock',                    'available': product.stock,                    'requested': quantity                },                status=status.HTTP_422_UNPROCESSABLE_ENTITY            )                serializer.save()        return Response(serializer.data, status=status.HTTP_201_CREATED)        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

429 Too Many Requests:

Use Case: Rate limiting exceeded
Has Body: Yes (rate limit info)
Header: Retry-After

from rest_framework.throttling import UserRateThrottle class CustomThrottle(UserRateThrottle):    rate = '10/minute' class RateLimitedView(APIView):    throttle_classes = [CustomThrottle]        def get(self, request):        return Response({'data': 'Rate limited content'}) # Automatic response when exceeded:# {#     "detail": "Request was throttled. Expected available in 45 seconds."# }

Server Error Responses (5xx)

500 Internal Server Error:

Use Case: Unhandled server errors
Has Body: Yes (error message)
Automatic in production

# DRF handles automatically# In DEBUG=False, returns:{    "detail": "Internal server error."} # Custom handling:from rest_framework.views import exception_handler def custom_exception_handler(exc, context):    response = exception_handler(exc, context)        if response is None:        # Unhandled exception        return Response(            {                'error': 'Internal server error',                'message': 'An unexpected error occurred'            },            status=status.HTTP_500_INTERNAL_SERVER_ERROR        )        return response # In settings.py:REST_FRAMEWORK = {    'EXCEPTION_HANDLER': 'myapp.utils.custom_exception_handler'}

503 Service Unavailable:

Use Case: Maintenance, temporary unavailability
Has Body: Yes (maintenance info)
Header: Retry-After

class MaintenanceMiddleware:    def __init__(self, get_response):        self.get_response = get_response        def __call__(self, request):        if settings.MAINTENANCE_MODE:            return JsonResponse(                {                    'error': 'Service unavailable',                    'message': 'System is under maintenance',                    'retry_after': 3600  # 1 hour                },                status=503,                headers={'Retry-After': '3600'}            )                return self.get_response(request)

Status Code Best Practices

1. Be Specific:

# ❌ Bad: Generic 400 for everythingif not article:    return Response({'error': 'Error'}, status=400) # ✅ Good: Specific status codesif not article:    return Response({'error': 'Not found'}, status=404) if article.author != request.user:    return Response({'error': 'Forbidden'}, status=403)

2. Include Error Details:

# ❌ Bad: No detailsreturn Response(status=400) # ✅ Good: Clear error messagereturn Response(    {        'error': 'Validation failed',        'details': {            'email': ['Invalid email format'],            'age': ['Must be at least 18']        }    },    status=400)

3. Consistent Error Format:

# Standard error response formatdef error_response(message, details=None, status_code=400):    response_data = {        'error': True,        'message': message,        'timestamp': timezone.now().isoformat()    }        if details:        response_data['details'] = details        return Response(response_data, status=status_code) # Usage:return error_response(    'Validation failed',    details=serializer.errors,    status_code=status.HTTP_400_BAD_REQUEST)

4. Use DRF Status Constants:

from rest_framework import status # ✅ Good: Readable and maintainablereturn Response(data, status=status.HTTP_201_CREATED) # ❌ Bad: Magic numbersreturn Response(data, status=201)

Complete Status Code Cheatsheet

# SUCCESS (2xx)status.HTTP_200_OK                    # GET, PUT, PATCH successstatus.HTTP_201_CREATED               # POST successstatus.HTTP_202_ACCEPTED              # Async processingstatus.HTTP_204_NO_CONTENT            # DELETE success # CLIENT ERRORS (4xx)status.HTTP_400_BAD_REQUEST           # Validation errorstatus.HTTP_401_UNAUTHORIZED          # Auth requiredstatus.HTTP_403_FORBIDDEN             # No permissionstatus.HTTP_404_NOT_FOUND             # Resource not foundstatus.HTTP_405_METHOD_NOT_ALLOWED    # Method not supportedstatus.HTTP_409_CONFLICT              # Resource conflictstatus.HTTP_422_UNPROCESSABLE_ENTITY  # Semantic errorstatus.HTTP_429_TOO_MANY_REQUESTS     # Rate limit # SERVER ERRORS (5xx)status.HTTP_500_INTERNAL_SERVER_ERROR # Server errorstatus.HTTP_503_SERVICE_UNAVAILABLE   # Maintenance

Format Suffixes

What are Format Suffixes?

Format suffixes = URL extensions that specify response format.

Examples:

/api/articles/         → Default format (JSON)/api/articles/.json    → JSON format/api/articles/.api     → Browsable API/api/articles/.xml     → XML format/api/articles/123/.json    → JSON for single resource

Basic Setup

1. Enable in URLs:

# urls.pyfrom django.urls import pathfrom rest_framework.urlpatterns import format_suffix_patternsfrom .views import ArticleListView, ArticleDetailView urlpatterns = [    path('articles/', ArticleListView.as_view(), name='article-list'),    path('articles/<int:pk>/', ArticleDetailView.as_view(), name='article-detail'),] # Add format suffix supporturlpatterns = format_suffix_patterns(urlpatterns)

Generated URLs:

/api/articles//api/articles.json/api/articles.api/api/articles/123//api/articles/123/.json/api/articles/123/.api

2. Accept format in Views:

class ArticleListView(APIView):    def get(self, request, format=None):  # ✅ Add format parameter        articles = Article.objects.all()        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)        def post(self, request, format=None):  # ✅ Add format parameter        serializer = ArticleSerializer(data=request.data)        if serializer.is_valid():            serializer.save()            return Response(serializer.data, status=status.HTTP_201_CREATED)        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST) class ArticleDetailView(APIView):    def get(self, request, pk, format=None):  # ✅ Add format parameter        article = self.get_object(pk)        serializer = ArticleSerializer(article)        return Response(serializer.data)        def put(self, request, pk, format=None):  # ✅ Add format parameter        article = self.get_object(pk)        serializer = ArticleSerializer(article, data=request.data)        if serializer.is_valid():            serializer.save()            return Response(serializer.data)        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Testing Format Suffixes

Browser:

http://localhost:8000/api/articles/         # Defaulthttp://localhost:8000/api/articles.json     # JSONhttp://localhost:8000/api/articles.api      # Browsable API

curl:

# Default formatcurl http://localhost:8000/api/articles/ # JSON formatcurl http://localhost:8000/api/articles.json # With Accept header (alternative)curl http://localhost:8000/api/articles/ \  -H "Accept: application/json"

Custom Format Suffixes

Limit allowed formats:

# Only allow .json and .apiurlpatterns = format_suffix_patterns(    urlpatterns,    allowed=['json', 'api'])

Custom suffix behavior:

class ArticleListView(APIView):    def get(self, request, format=None):        articles = Article.objects.all()                # Custom handling based on format        if format == 'csv':            # Return CSV            import csv            from django.http import HttpResponse                        response = HttpResponse(content_type='text/csv')            response['Content-Disposition'] = 'attachment; filename="articles.csv"'                        writer = csv.writer(response)            writer.writerow(['ID', 'Title', 'Author'])            for article in articles:                writer.writerow([article.id, article.title, article.author.username])                        return response                # Default: JSON        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

Browsable API

What is Browsable API?

Browsable API = Human-friendly web interface for your API.

Features:

🌐 Web UI for testing endpoints
📝 HTML forms for POST/PUT/PATCH
🔍 View response data formatted
🔐 Login/logout support
📚 Self-documenting
🎨 Bootstrap styling

Accessing Browsable API

Open in browser:

http://localhost:8000/api/articles/http://localhost:8000/api/articles/123/

Key Elements:

HTTP method tabs (GET, POST, OPTIONS)
Response viewer (formatted JSON/HTML)
Raw data toggle
Forms for POST/PUT/PATCH
Login/logout (top right)
Filters (if configured)

Customizing Browsable API

1. Change Page Title:

class ArticleListView(APIView):    """    Article List API        Retrieve list of all articles or create new article.    """        def get(self, request, format=None):        """List all articles"""        pass        def post(self, request, format=None):        """Create new article"""        pass

2. Custom API Root:

# views.pyfrom rest_framework.decorators import api_viewfrom rest_framework.response import Responsefrom rest_framework.reverse import reverse @api_view(['GET'])def api_root(request, format=None):    """    API Root        Welcome to the Blog API!    """    return Response({        'articles': reverse('article-list', request=request, format=format),        'users': reverse('user-list', request=request, format=format),        'categories': reverse('category-list', request=request, format=format),    }) # urls.pyurlpatterns = [    path('', api_root, name='api-root'),    path('articles/', ArticleListView.as_view(), name='article-list'),    # ...]

3. Add Description to Responses:

class ArticleListView(APIView):    def get(self, request, format=None):        articles = Article.objects.all()        serializer = ArticleSerializer(articles, many=True)                return Response({            'count': articles.count(),            'results': serializer.data,            '_meta': {                'description': 'List of all published articles',                'version': 'v1',                'endpoints': {                    'list': '/api/articles/',                    'detail': '/api/articles/{id}/'                }            }        })

4. Disable Browsable API (Production):

# settings.pyREST_FRAMEWORK = {    'DEFAULT_RENDERER_CLASSES': [        'rest_framework.renderers.JSONRenderer',        # Remove BrowsableAPIRenderer in production    ],} # Or conditionally:if DEBUG:    REST_FRAMEWORK['DEFAULT_RENDERER_CLASSES'] = [        'rest_framework.renderers.JSONRenderer',        'rest_framework.renderers.BrowsableAPIRenderer',    ]else:    REST_FRAMEWORK['DEFAULT_RENDERER_CLASSES'] = [        'rest_framework.renderers.JSONRenderer',    ]

Browsable API Forms

Automatic Forms:

# DRF automatically generates forms based on serializerclass ArticleSerializer(serializers.ModelSerializer):    class Meta:        model = Article        fields = ['id', 'title', 'content', 'status'] # Browsable API will show form with:# - title: <input type="text"># - content: <textarea># - status: <select> (dropdown for choices)

Custom Form Help Text:

class ArticleSerializer(serializers.ModelSerializer):    title = serializers.CharField(        max_length=200,        help_text='Article title (max 200 characters)'    )    content = serializers.CharField(        style={'base_template': 'textarea.html', 'rows': 10},        help_text='Article content in Markdown format'    )        class Meta:        model = Article        fields = ['title', 'content', 'status']

Browsable API Best Practices

1. Add Docstrings:

class ArticleListView(APIView):    """    Article List Endpoint        ## GET    Retrieve paginated list of articles.        ### Query Parameters:    - `status`: Filter by status (draft/published)    - `author`: Filter by author ID    - `search`: Search in title    - `page`: Page number (default: 1)        ## POST    Create new article.        ### Required Fields:    - `title`: Article title (max 200 chars)    - `content`: Article content (min 100 chars)    - `status`: draft or published    """        def get(self, request, format=None):        """List articles with filtering"""        pass        def post(self, request, format=None):        """Create new article"""        pass

2. Provide Examples:

class ArticleSerializer(serializers.ModelSerializer):    class Meta:        model = Article        fields = ['title', 'content', 'status']        def to_representation(self, instance):        """Add example data to schema"""        representation = super().to_representation(instance)                if getattr(self, 'is_schema_request', False):            # Add example for documentation            representation['_example'] = {                'title': 'My First Article',                'content': 'This is the article content...',                'status': 'published'            }                return representation

3. Use Hyperlinking:

from rest_framework.reverse import reverse class ArticleSerializer(serializers.ModelSerializer):    url = serializers.SerializerMethodField()    author_url = serializers.SerializerMethodField()        class Meta:        model = Article        fields = ['id', 'url', 'title', 'author_url']        def get_url(self, obj):        request = self.context.get('request')        return reverse('article-detail', kwargs={'pk': obj.pk}, request=request)        def get_author_url(self, obj):        request = self.context.get('request')        return reverse('user-detail', kwargs={'pk': obj.author.pk}, request=request)

Content Negotiation

What is Content Negotiation?

Content negotiation = Process of selecting best representation for a response.

Based on:

Accept header (application/json, text/html, application/xml)
Format suffix (.json, .xml, .api)
Query parameter (?format=json)

How It Works

Client sends Accept header:

curl http://localhost:8000/api/articles/ \  -H "Accept: application/json"

DRF selects renderer:

Check format suffix (.json, .xml)
Check query param (?format=json)
Check Accept header
Use default renderer

Multiple Renderers

Enable XML Support:

pip install djangorestframework-xml

Configure:

# settings.pyREST_FRAMEWORK = {    'DEFAULT_RENDERER_CLASSES': [        'rest_framework.renderers.JSONRenderer',        'rest_framework.renderers.BrowsableAPIRenderer',        'rest_framework_xml.renderers.XMLRenderer',    ],}

Request XML:

# Via Accept headercurl http://localhost:8000/api/articles/ \  -H "Accept: application/xml" # Via format suffixcurl http://localhost:8000/api/articles.xml # Via query parametercurl http://localhost:8000/api/articles/?format=xml

Response:

<?xml version="1.0" encoding="utf-8"?><root>    <list-item>        <id>1</id>        <title>First Article</title>        <content>Content here...</content>    </list-item>    <list-item>        <id>2</id>        <title>Second Article</title>        <content>More content...</content>    </list-item></root>

Custom Renderers

CSV Renderer:

# renderers.pyfrom rest_framework import renderersimport csvfrom io import StringIO class CSVRenderer(renderers.BaseRenderer):    media_type = 'text/csv'    format = 'csv'        def render(self, data, accepted_media_type=None, renderer_context=None):        """Render data as CSV"""        if not data:            return ''                # Handle list of items        if isinstance(data, list):            if not data:                return ''                        # Get keys from first item            keys = data[0].keys()                        # Create CSV            output = StringIO()            writer = csv.DictWriter(output, fieldnames=keys)            writer.writeheader()            writer.writerows(data)                        return output.getvalue()                # Handle single item        if isinstance(data, dict):            output = StringIO()            writer = csv.DictWriter(output, fieldnames=data.keys())            writer.writeheader()            writer.writerow(data)            return output.getvalue()                return str(data)

Use in View:

from .renderers import CSVRenderer class ArticleListView(APIView):    renderer_classes = [        renderers.JSONRenderer,        renderers.BrowsableAPIRenderer,        CSVRenderer,    ]        def get(self, request, format=None):        articles = Article.objects.all()        serializer = ArticleSerializer(articles, many=True)        return Response(serializer.data)

Request CSV:

curl http://localhost:8000/api/articles.csv

Response:

id,title,content,status,created_at1,First Article,Content here...,published,2024-01-012,Second Article,More content...,draft,2024-01-02

Excel Renderer

# renderers.pyfrom rest_framework import renderersimport openpyxlfrom openpyxl.utils import get_column_letterfrom io import BytesIO class ExcelRenderer(renderers.BaseRenderer):    media_type = 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'    format = 'xlsx'        def render(self, data, accepted_media_type=None, renderer_context=None):        """Render data as Excel"""        if not data:            return b''                # Create workbook        wb = openpyxl.Workbook()        ws = wb.active        ws.title = 'Data'                if isinstance(data, list) and data:            # Write headers            headers = list(data[0].keys())            for col, header in enumerate(headers, start=1):                ws.cell(row=1, column=col, value=header)                        # Write data            for row_idx, item in enumerate(data, start=2):                for col_idx, key in enumerate(headers, start=1):                    ws.cell(row=row_idx, column=col_idx, value=str(item.get(key, '')))                        # Auto-size columns            for col in range(1, len(headers) + 1):                ws.column_dimensions[get_column_letter(col)].width = 15                # Save to bytes        output = BytesIO()        wb.save(output)        return output.getvalue()

Per-View Renderers

Different renderers for different views:

class ArticleListView(APIView):    # JSON, Browsable API, CSV    renderer_classes = [        renderers.JSONRenderer,        renderers.BrowsableAPIRenderer,        CSVRenderer,    ]        def get(self, request, format=None):        pass class ArticleStatsView(APIView):    # Only JSON (no CSV for complex stats)    renderer_classes = [renderers.JSONRenderer]        def get(self, request, format=None):        pass

Renderer Priority

Order matters:

REST_FRAMEWORK = {    'DEFAULT_RENDERER_CLASSES': [        'rest_framework.renderers.JSONRenderer',        # 1st priority        'rest_framework.renderers.BrowsableAPIRenderer', # 2nd priority        'myapp.renderers.CSVRenderer',                   # 3rd priority    ],}

Without format suffix:

Browser: Gets BrowsableAPIRenderer (HTML)
curl/API client: Gets JSONRenderer (JSON)

With format suffix:

.json → JSONRenderer
.api → BrowsableAPIRenderer
.csv → CSVRenderer

API Testing Strategies

Testing with curl

Basic GET:

curl http://localhost:8000/api/articles/

GET with query params:

curl "http://localhost:8000/api/articles/?status=published&page=2"

POST with JSON:

curl -X POST http://localhost:8000/api/articles/ \  -H "Content-Type: application/json" \  -H "Authorization: Token abc123xyz" \  -d '{    "title": "New Article",    "content": "Article content here...",    "status": "draft"  }'

PUT update:

curl -X PUT http://localhost:8000/api/articles/123/ \  -H "Content-Type: application/json" \  -d '{    "title": "Updated Title",    "content": "Updated content...",    "status": "published"  }'

PATCH partial update:

curl -X PATCH http://localhost:8000/api/articles/123/ \  -H "Content-Type: application/json" \  -d '{"status": "published"}'

DELETE:

curl -X DELETE http://localhost:8000/api/articles/123/ \  -H "Authorization: Token abc123xyz"

View headers:

curl -I http://localhost:8000/api/articles/

Pretty print JSON:

curl http://localhost:8000/api/articles/ | python -m json.tool

Testing with HTTPie

Install:

pip install httpie

Basic requests:

# GEThttp GET localhost:8000/api/articles/ # POST (JSON automatic)http POST localhost:8000/api/articles/ \  title="New Article" \  content="Content here..." \  status=draft # PUThttp PUT localhost:8000/api/articles/123/ \  title="Updated" \  content="Updated content" \  status=published # PATCHhttp PATCH localhost:8000/api/articles/123/ status=published # DELETEhttp DELETE localhost:8000/api/articles/123/

With authentication:

http GET localhost:8000/api/articles/ \  "Authorization: Token abc123xyz"

Custom headers:

http GET localhost:8000/api/articles/ \  Accept:application/json \  User-Agent:MyApp/1.0

Upload file:

http -f POST localhost:8000/api/upload/ \  file@/path/to/image.jpg \  title="My Image"

Testing with Postman

Setup Collection:

Create collection: "Blog API"
Add environment variables:
- base_url: http://localhost:8000
- token: abc123xyz

GET Request:

GET {{base_url}}/api/articles/Headers:  Authorization: Token {{token}}

POST Request:

POST {{base_url}}/api/articles/Headers:  Authorization: Token {{token}}  Content-Type: application/jsonBody (JSON):  {    "title": "New Article",    "content": "Content here...",    "status": "draft"  }

Tests (in Postman):

// Test status codepm.test("Status code is 201", function () {    pm.response.to.have.status(201);}); // Test response structurepm.test("Response has required fields", function () {    var json = pm.response.json();    pm.expect(json).to.have.property('id');    pm.expect(json).to.have.property('title');    pm.expect(json).to.have.property('content');}); // Save ID for next requestpm.test("Save article ID", function () {    var json = pm.response.json();    pm.environment.set("article_id", json.id);});

Automated Testing

Test CRUD operations:

# tests.pyfrom rest_framework.test import APITestCase, APIClientfrom rest_framework import statusfrom django.contrib.auth.models import Userfrom .models import Article class ArticleAPITestCase(APITestCase):    def setUp(self):        """Setup test data"""        self.client = APIClient()        self.user = User.objects.create_user(            username='testuser',            password='testpass123'        )        self.article = Article.objects.create(            title='Test Article',            content='Test content',            status='draft',            author=self.user        )        def test_list_articles(self):        """Test GET /api/articles/"""        response = self.client.get('/api/articles/')                self.assertEqual(response.status_code, status.HTTP_200_OK)        self.assertEqual(len(response.data), 1)        self.assertEqual(response.data[0]['title'], 'Test Article')        def test_create_article(self):        """Test POST /api/articles/"""        self.client.force_authenticate(user=self.user)                data = {            'title': 'New Article',            'content': 'New content' * 20,  # Min 100 chars            'status': 'draft'        }                response = self.client.post('/api/articles/', data, format='json')                self.assertEqual(response.status_code, status.HTTP_201_CREATED)        self.assertEqual(Article.objects.count(), 2)        self.assertEqual(response.data['title'], 'New Article')        def test_retrieve_article(self):        """Test GET /api/articles/{id}/"""        response = self.client.get(f'/api/articles/{self.article.id}/')                self.assertEqual(response.status_code, status.HTTP_200_OK)        self.assertEqual(response.data['title'], 'Test Article')        def test_update_article(self):        """Test PUT /api/articles/{id}/"""        self.client.force_authenticate(user=self.user)                data = {            'title': 'Updated Title',            'content': 'Updated content' * 20,            'status': 'published'        }                response = self.client.put(            f'/api/articles/{self.article.id}/',            data,            format='json'        )                self.assertEqual(response.status_code, status.HTTP_200_OK)        self.article.refresh_from_db()        self.assertEqual(self.article.title, 'Updated Title')        self.assertEqual(self.article.status, 'published')        def test_partial_update_article(self):        """Test PATCH /api/articles/{id}/"""        self.client.force_authenticate(user=self.user)                data = {'status': 'published'}                response = self.client.patch(            f'/api/articles/{self.article.id}/',            data,            format='json'        )                self.assertEqual(response.status_code, status.HTTP_200_OK)        self.article.refresh_from_db()        self.assertEqual(self.article.status, 'published')        def test_delete_article(self):        """Test DELETE /api/articles/{id}/"""        self.client.force_authenticate(user=self.user)                response = self.client.delete(f'/api/articles/{self.article.id}/')                self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)        self.assertEqual(Article.objects.count(), 0)        def test_article_not_found(self):        """Test 404 for non-existent article"""        response = self.client.get('/api/articles/9999/')                self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)        def test_create_article_validation(self):        """Test validation errors"""        self.client.force_authenticate(user=self.user)                data = {            'title': '',  # Required field            'content': 'Short',  # Too short        }                response = self.client.post('/api/articles/', data, format='json')                self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)        self.assertIn('title', response.data)        self.assertIn('content', response.data)

Run tests:

python manage.py test myapp.tests.ArticleAPITestCase

Tóm Tắt Bài 4.2

Trong Bài 4.2 này, bạn đã học:

✅ HTTP Status Codes:

Success codes: 200 OK, 201 Created, 204 No Content
Client errors: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
Server errors: 500 Internal Server Error
Best practices: Be specific, include details, consistent format

✅ Format Suffixes:

Enable with format_suffix_patterns()
URL patterns: .json, .api, .xml, .csv
Accept format parameter in views
Custom format handling

✅ Browsable API:

Human-friendly web interface
Automatic forms for POST/PUT/PATCH
Customization: docstrings, API root, descriptions
Disable in production for security

✅ Content Negotiation:

Accept header based selection
Multiple renderers (JSON, XML, CSV, Excel)
Custom renderer implementation
Per-view renderer configuration

✅ API Testing:

curl commands for all HTTP methods
HTTPie for simplified testing
Postman collections and tests
Automated testing with APITestCase

Exercises

Exercise 1: Status Code Implementation

Implement proper status codes for a User API:

class UserRegistrationView(APIView):    def post(self, request):        # TODO: Implement with proper status codes        # - 201 if created successfully        # - 400 if validation fails        # - 409 if username/email already exists        pass

Requirements:

Return 201 Created with Location header
Return 409 Conflict if username exists
Return 400 Bad Request with validation details
Include meaningful error messages

Exercise 2: Custom CSV Renderer

Create ProductCSVRenderer:

class Product(models.Model):    name = models.CharField(max_length=200)    sku = models.CharField(max_length=50)    price = models.DecimalField(max_digits=10, decimal_places=2)    stock = models.IntegerField()    category = models.ForeignKey(Category)

Requirements:

Export products as CSV
Include headers: SKU, Name, Price, Stock, Category
Handle empty queryset
Format price with 2 decimals
Support both list and single item

Exercise 3: Multi-Format API

Build Order API with multiple formats:

Requirements:

Support JSON, XML, CSV, Excel formats
JSON: Full order details with nested items
CSV: Flat structure (order_id, customer, total, items_count)
Excel: Multiple sheets (Orders, Items, Summary)
Add format suffix support
Test with curl/HTTPie/Postman

Exercise 4: API Test Suite

Write comprehensive tests for Article API:

Requirements:

Test all CRUD operations
Test status codes (200, 201, 204, 400, 404)
Test authentication (401, 403)
Test validation errors
Test filtering and search
Test pagination
90%+ code coverage

Next Steps

Trong Bài 4.3, bạn sẽ học:

Authentication methods (Token, JWT, Session)
Permission classes (IsAuthenticated, IsAdminUser, Custom)
Object-level permissions
Throttling & rate limiting
Security best practices
OAuth2 integration

Navigation:

← Bài 4.1: DRF Introduction & APIView
Bài 4.2: Status Codes & Browsable API (current)
Bài 4.3: Authentication & Permissions →

#status-codes

Status Codes, Format Suffixes & Browsable API - Phần 2