title: composite key resource REST service
body: <p>I've come across a problem at work where I can't find information on the usual standard or practice for performing CRUD operations in a RESTful web service against a resource whose primary key is a composite of other resource ids.  We are using MVC WebApi to create the controllers.  For example, we have three tables:</p>
  
  <ul>
  <li><code>Product</code>: PK=ProductId</li>
  <li><code>Part</code>: PK=PartId</li>
  <li><code>ProductPartAssoc</code>: PK=(ProductId, PartId)</li>
  </ul>
  
  <p>A product can have many parts and a part can be a component of many products.  The association table also contains additional information relevant to the association itself than needs to be editable.</p>
  
  <p>We have <code>ProductsController</code> and <code>PartsController</code> classes that handle the usual GET/PUT/POST/DELETE operations using route templates defined as: <code>{controller}/{id}/{action}</code> such that the following IRIs work:</p>
  
  <ul>
  <li>GET,POST       <code>/api/Products</code> - returns all products, creates a new product</li>
  <li>GET,PUT,DELETE <code>/api/Products/1</code> - retrieves/updates/deletes product 1</li>
  <li>GET,POST       <code>/api/Parts</code> - returns all parts, creates a new part</li>
  <li>GET,PUT,DELETE <code>/api/Parts/2</code> - retrieves/updates/deletes part 2</li>
  <li>GET            <code>/api/Products/1/Parts</code> - get all parts for product 1</li>
  <li>GET            <code>/api/Parts/2/Products</code> - get all products for which part 2 is a component</li>
  </ul>
  
  <p>Where I am having trouble is in how to define the route template for ProductPartAssoc resources.  What should the route template and IRI look like for getting the association data?
  Adhering to convention, I would expect something like:</p>
  
  <ul>
  <li>GET,POST       <code>/api/ProductPartAssoc</code> - returns all associations, creates an association</li>
  <li>GET,PUT,DELETE <code>/api/ProductPartAssoc/[1,2]</code> - retrieves/updates/deletes association between product 1 and part 2</li>
  </ul>
  
  <p>My coworkers find this aesthetically displeasing though and seem to think it would be better to not have a <code>ProductPartAssocController</code> class at all, but rather, add additional methods to the <code>ProductsController</code> to manage the association data:</p>
  
  <ul>
  <li>GET,PUT,DELETE <code>/api/Products/1/Parts/2</code> - get data for the association between product 1 and part 2 rather than data for part 2 as a member of part 1, which would conventionally be the case based on other examples such as <code>/Book/5/Chapter/3</code> that I have seen elsewhere.</li>
  <li>POST           No clue here what they expect the IRI to look like.  Unfortunately, they're the decision makers.</li>
  </ul>
  
  <p>At the end of the day, I guess what I am seeking is either validation, or direction that I can point to and say "See, this is what other people do."  </p>
  
  <p>What is the typical practice for dealing with resources identified by composite keys?</p>