Responses include related resource links
Why it matters
A response that includes userId but no information about how to fetch the user forces every consumer to hardcode the URL pattern /api/v1/users/{userId}. When that pattern changes, every consumer breaks — and there is no machine-readable artifact that could have warned them. iso-25010:2011 compatibility.interoperability is the direct gap: the API returns foreign keys but not the means to navigate them, making the API partially self-describing at best and requiring consumers to maintain their own URL construction knowledge.
Severity rationale
Info because missing resource links are a navigability improvement rather than a functional defect — consumers can work around the gap by hardcoding URL patterns, but it makes the API less self-documenting.
Remediation
Add basic resource linking to make responses partially self-describing. Even just self URLs are a meaningful improvement over bare IDs:
// Before -- ID only, consumer must know URL pattern:
{
"id": "order-123",
"userId": "user-456"
}
// After -- with links:
{
"id": "order-123",
"userId": "user-456",
"_links": {
"self": "/api/v1/orders/order-123",
"user": "/api/v1/users/user-456"
}
}
Start with self links on every resource — that alone lets consumers build shareable URLs and canonical references. Add related resource links for the two or three relationships consumers navigate most frequently.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · compatibility.interoperability — Interoperability — resource links enable consumer navigation without hardcoded URL patterns
Taxons
History
- 2026-04-18·v1.0.0·Initial import from api-design·automated