This where I feel is the problem lies that is while mapping CRUD to HTTP methods.
Understand this, POST may not be the best method to create resource. This is because semantics of other methods are determined by the HTTP protocol, but the semantics of POST are determined by the target media type itself.
POST is used for creation, but can be used for updates. It's wrong to use POST for retrieval, since you have GET standardized for that, but it's fine to use POST for creating a resource when the client can't use PUT for some reason.
PUT on the other hand is not the "correct method for updating resource".
PUT is the method used to replace a resource completely, ignoring its current state. It's not right to use PUT for partial updates, because you're asking for the server to consider the current state of the resource. PATCH is the method to do that.
These are the definitions:
-
POST: Takes in data, applies it to the resource identified by the given URI, here the rules you documented for the resource media type are followed.
-
PUT: It will replace whatever is identified by the given URI with this data, and ignore whatever is in there already, if anything.
-
PATCH: if the resource identified by the given URI still has the same state it had the last time, apply this diff to it.
It is possible to create with POST and PUT, but not PATCH, because it is dependent on current state. You can update with any of them, but with PATCH you have an update conditional to the state you want to update from, with PUT you update by replacing the whole entity, so it's an idempotent operation, and with POST you ask the server to do it according to predefined rules.