title: Best practice for partial updates in a RESTful service
body: <p>I am writing a RESTful service for a customer management system and I am trying to find the best practice for updating records partially. For example, I want the caller to be able to read the full record with a GET request. But for updating it only certain operations on the record are allowed, like change the status from ENABLED to DISABLED. (I have more complex scenarios than this) </p>
  
  <p>I don't want the caller to submit the entire record with just the updated field for security reasons (it also feels like overkill).</p>
  
  <p>Is there a recommended way of constructing the URIs? When reading the REST books RPC style calls seem to be frowned upon.</p>
  
  <p>If the following call returns the full customer record for the customer with the id 123</p>
  
  <pre><code>GET /customer/123
  &lt;customer&gt;
      {lots of attributes}
      &lt;status&gt;ENABLED&lt;/status&gt;
      {even more attributes}
  &lt;/customer&gt;
  </code></pre>
  
  <p>how should I update the status?</p>
  
  <pre><code>POST /customer/123/status
  &lt;status&gt;DISABLED&lt;/status&gt;
  
  POST /customer/123/changeStatus
  DISABLED
  
  ...
  </code></pre>
  
  <p><strong>Update</strong>: To augment the question. How does one incorporate 'business logic calls' into a REST api? Is there an agreed way of doing this? Not all of the methods are CRUD by nature. Some are more complex, like '<em>sendEmailToCustomer(123)</em>', '<em>mergeCustomers(123, 456)</em>', '<em>countCustomers()</em>'</p>
  
  <pre><code>POST /customer/123?cmd=sendEmail
  
  POST /cmd/sendEmail?customerId=123
  
  GET /customer/count 
  </code></pre>