Spring REST api - foreign key ID instead of entire object

Question

I have a problem with Json returned by my REST api GET method.

That's how my entities looks like:

@Entity
public class Employee {
    ...
    @ManyToOne(fetch = FetchType.EAGER, optional = false)
    @JoinColumn(name = "department_id", nullable = true)
    private Department department;
}

@Entity
public class Department {
    ...
    @OneToMany(mappedBy = "department", fetch = FetchType.EAGER, cascade = CascadeType.ALL)
    @JsonBackReference
    private Set<Employee> employees;
}

And this is the answer I get, while I'm trying to GET Employee by its id:

{
    "id": 1,
    "surname": "smith",
    "department": {
      "id": 1,
      "name": "HR",
      "room": "13"
    }
}

Now, Instead entire Department object, I would like to get just simple id: "department_id": 1, and I don't know how to do that.

Second question: what's the good practise in this situation in REST api? Should I leave it like it is; expose only id (what I'm asking you how to do); or use DTO and not showing it at all? Moreover, anyway I'm going to add _links to this user's department, and in this case i thought that leaving only id should be ok (tell me if I'm wrong). Looking forward for your answers!

Henrique Forlani · Accepted Answer · 2020-06-18T15:58:00.647

A good practice is to define a DTO that represents the data that is exposed by your API. This should be decoupled from your domain (Employee) as it will offer you more flexibility, just like what you want to achieve.

class EmployeeDTO extends RepresentationModel {
    private long id;
    private String surname;
    private long departmentId;

   // getters and setters
}

This should work. Of course you need to map your Employee entity to the EmployeeDTO. RepresentationModel contains the _links property that you want for the HATEOAS (for example, have a look at https://www.baeldung.com/spring-hateoas-tutorial )

About exposing the id from your database, I think that a good reason for not doing it is that you are giving information about your database size for free and it's something that you might not want to. More information could even be derived from that.

Here you can find a good discussion on the topic: Exposing database IDs - security risk?

I would suggest to have a look at UUID which is a universally unique alphanumeric identifier that doesn't expose this information about your data. More about UUID: https://www.baeldung.com/java-uuid

Hey, could you give a hint, or point an example, how to map Entity to DTO that extends RepresentationModel? Right now, to add links im using class that ```implements RepresentationModelAssembler>```, and then inside toModel function im calling ```EntityModel.of(employee);``` — Nickname11, Jun 18 '20 at 20:49
@Nickname11 I answered your other question, have a look if it suits you — Henrique Forlani, Jun 19 '20 at 18:16

Romil Patel · Answer 2 · 2020-06-18T16:08:04.293

@JsonIgnoreProperties

To just get department id without changing any implementation you may use @JsonIgnoreProperties({"name", "room"}) as following

@ManyToOne(fetch = FetchType.EAGER, optional = false)
@JoinColumn(name = "department_id", nullable = true)
@JsonIgnoreProperties({"name", "room"})
private Department department;

which will respond with the following

[
    {
        "id": 1,
        "surname": "smith",
        "department": {
            "id": 1
        }
    }
]

You may also like to explore other ways to achieve the same here

Best Practices

We should never expose and return our modal and entities as a response to APIs. We may create the DTOs/DAOs to receive and transfer the objects and data. You may also convert the entity to DTO and DTO to entity using mappers.

In the case of DTO, you may just include the department id and may fetch the object if required using the repository.

Spring REST api - foreign key ID instead of entire object

2 Answers2