When do you use path parameters, query parameters and a request body?

Each one has a job. The path identifies a resource, the query string shapes a read, and the body carries data to create or change a resource.

GET   /orders/42                      # path: which order
GET   /orders?status=paid&limit=20    # query: filter and page a list
POST  /orders                         # body: the new order
PATCH /orders/42                      # path: which one, body: what to change

• Path parameters are required and name the resource: /orders/42.
• Query parameters are optional and refine a collection: filtering, sorting, paging, field selection.
• Body (usually JSON) holds structured data for POST, PUT and PATCH. A GET has no defined body meaning, so do not rely on one.

URLs end up in browser history, server logs and proxies, so never put passwords, tokens or personal data in the path or query. Send secrets in headers like Authorization or in the body.

Use headers for metadata about the request, such as content type, language and auth.