ASP.NET Core Web API · Data

CRUD API

This is the core of most APIs: list, get, create, update and delete a resource. We put together everything so far — DTOs, validation, EF Core, status codes, CancellationToken — into ShopSmart’s products API and drive it end to end.

Intermediate 7 min Lesson 16 of 37Examples target .NET 9.

Before you start:Entity Framework Core Model Validation

0/37 in ASP.NET Core Web API

On this page · 7 min · Intermediate

Interview questions

In simple words#

A CRUD API is the four service windows of any record office: create, read, update and delete — each with its own verb and status code.

POST → 201: Created, with Location header.
GET → 200 / 404: Found / not found.
PUT/DELETE → 204: Done, nothing to return.

Learning objectives#

Create an [ApiController] with all five CRUD actions
Use DTOs for input and output
Return 200, 201, 204, 400 and 404 correctly
Use async EF Core calls with cancellation

Explanation#

GET /api/products returns a list (projected to DTOs, AsNoTracking). GET /api/products/{id} returns one or 404.

POST validates the input DTO automatically ([ApiController]), saves the entity and returns 201 with CreatedAtAction — a Location header and the created DTO.

PUT replaces the editable fields of an existing product and returns 204 No Content; 404 if it does not exist.

DELETE removes with ExecuteDeleteAsync in a single statement and returns 204, or 404 when nothing was deleted.

Every action is async and accepts a CancellationToken. Business rules (unique names, stock rules) would move to a service as the API grows.

Syntax#

Text Illustrative

1GET    /api/products        200 [ … ]
2GET    /api/products/{id}   200 { … } | 404
3POST   /api/products        201 + Location | 400
4PUT    /api/products/{id}   204 | 400 | 404
5DELETE /api/products/{id}   204 | 404

Code example: ProductsController, driven end to end#

C#Controllers/ProductsController.cs Illustrative

1// Program.cs
2using System.Net.Http.Json;
3using Microsoft.EntityFrameworkCore;
4

5var builder = WebApplication.CreateBuilder(args);
6builder.Logging.ClearProviders();                                    // keep the demo output clean
7builder.Services.AddControllers();
8builder.Services.AddRouting(o => o.LowercaseUrls = true);            // Location: /api/products/1, not /api/Products/1
9builder.Services.AddDbContext<AppDbContext>(o => o.UseSqlServer(
10    @"Server=(localdb)\mssqllocaldb;Database=ShopSmartApi_Crud;Trusted_Connection=True;TrustServerCertificate=True"));
11var app = builder.Build();
12using (var scope = app.Services.CreateScope())
13{
14    var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
15    await db.Database.EnsureDeletedAsync();                           // demo only: use migrations in real apps
16    await db.Database.EnsureCreatedAsync();
17}
18app.MapControllers();
19app.Urls.Add("http://127.0.0.1:5216");
20await app.StartAsync();
21

22using var http = new HttpClient { BaseAddress = new Uri("http://127.0.0.1:5216") };
23async Task Show(string label, Task<HttpResponseMessage> call)
24{
25    var response = await call;
26    var location = response.Headers.Location is { } url ? 
quot; Location: {url.AbsolutePath}" : "";
27    var body = response.Content.Headers.ContentType?.MediaType == "application/problem+json" ? "(problem details)" : await response.Content.ReadAsStringAsync();
28    Console.WriteLine(
quot;{label,-22} {(int)response.StatusCode}{location} {body}".TrimEnd());
29}
30

31await Show("POST keyboard", http.PostAsJsonAsync("/api/products", new { name = "Keyboard", price = 2499 }));
32await Show("POST mouse", http.PostAsJsonAsync("/api/products", new { name = "Wireless Mouse", price = 799 }));
33await Show("POST invalid", http.PostAsJsonAsync("/api/products", new { name = "", price = 0 }));
34await Show("GET all", http.GetAsync("/api/products"));
35await Show("PUT keyboard", http.PutAsJsonAsync("/api/products/1", new { name = "Mechanical Keyboard", price = 3999 }));
36await Show("GET keyboard", http.GetAsync("/api/products/1"));
37await Show("DELETE mouse", http.DeleteAsync("/api/products/2"));
38await Show("GET mouse", http.GetAsync("/api/products/2"));
39await Show("DELETE mouse again", http.DeleteAsync("/api/products/2"));
40await app.StopAsync();
41using (var scope = app.Services.CreateScope())
42    await scope.ServiceProvider.GetRequiredService<AppDbContext>().Database.EnsureDeletedAsync();
43

44// Contracts/ProductDtos.cs
45using System.ComponentModel.DataAnnotations;
46

47public record ProductDto(int Id, string Name, decimal Price);
48public record SaveProductDto(
49    [Required, StringLength(100)] string Name,
50    [Range(0.01, 1_000_000)] decimal Price);
51

52// Controllers/ProductsController.cs
53using Microsoft.AspNetCore.Mvc;
54using Microsoft.EntityFrameworkCore;
55

56[ApiController]
57[Route("api/[controller]")]
58public class ProductsController(AppDbContext db) : ControllerBase
59{
60    [HttpGet]
61    public async Task<IEnumerable<ProductDto>> GetAll(CancellationToken ct) =>
62        await db.Products.AsNoTracking()
63            .OrderBy(p => p.Name)
64            .Select(p => new ProductDto(p.Id, p.Name, p.Price))
65            .ToListAsync(ct);
66

67    [HttpGet("{id:int}")]
68    public async Task<ActionResult<ProductDto>> Get(int id, CancellationToken ct)
69    {
70        var p = await db.Products.FindAsync([id], ct);
71        return p is null ? NotFound() : new ProductDto(p.Id, p.Name, p.Price);
72    }
73

74    [HttpPost]
75    public async Task<ActionResult<ProductDto>> Create(SaveProductDto dto, CancellationToken ct)
76    {
77        var p = new Product { Name = dto.Name, Price = dto.Price };
78        db.Products.Add(p);
79        await db.SaveChangesAsync(ct);
80        return CreatedAtAction(nameof(Get), new { id = p.Id }, new ProductDto(p.Id, p.Name, p.Price));
81    }
82

83    [HttpPut("{id:int}")]
84    public async Task<IActionResult> Update(int id, SaveProductDto dto, CancellationToken ct)
85    {
86        var p = await db.Products.FindAsync([id], ct);
87        if (p is null) return NotFound();
88        p.Name = dto.Name;
89        p.Price = dto.Price;
90        await db.SaveChangesAsync(ct);
91        return NoContent();
92    }
93

94    [HttpDelete("{id:int}")]
95    public async Task<IActionResult> Delete(int id, CancellationToken ct)
96    {
97        var affected = await db.Products.Where(p => p.Id == id).ExecuteDeleteAsync(ct);
98        return affected == 0 ? NotFound() : NoContent();
99    }
100}

Expected output

POST keyboard          201 Location: /api/products/1 {"id":1,"name":"Keyboard","price":2499}
POST mouse             201 Location: /api/products/2 {"id":2,"name":"Wireless Mouse","price":799}
POST invalid           400 (problem details)
GET all                200 [{"id":1,"name":"Keyboard","price":2499.00},{"id":2,"name":"Wireless Mouse","price":799.00}]
PUT keyboard           204
GET keyboard           200 {"id":1,"name":"Mechanical Keyboard","price":3999.00}
DELETE mouse           204
GET mouse              404 (problem details)
DELETE mouse again     404 (problem details)

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

POST returns 201 with a Location header built from the Get action and the created product.
Invalid input never reaches Create: [ApiController] returns 400 with validation problem details.
GET all is sorted by name and projected to DTOs (values read back from decimal(18,2) columns show two decimals); PUT returns 204 and the next GET shows the change.
DELETE uses ExecuteDeleteAsync (one SQL statement) and returns 204.
Getting or deleting the removed product returns 404. (AppDbContext and Product are the classes from the EF Core lessons.)

Real-world use case#

This exact controller shape backs ShopSmart’s products, categories and coupons, and the React and Angular projects later in this track call it.

Common mistakes#

Exposing entities directly

Binding the EF entity allows over-posting and leaks internal fields. Use DTOs.

Returning 200 for everything

Clients and tools rely on correct codes. Use 201, 204, 400 and 404 appropriately.

Blocking calls

ToListAsync and SaveChangesAsync — never .Result or .Wait() — keep the thread pool healthy.

Best practices#

DTOs for input and output
Route constraints such as {id:int}
Thin controllers; business rules in services
Pagination before lists grow
OpenAPI documentation

Remember this#

GET 200 · POST 201 + Location · PUT/DELETE 204 · missing 404 · invalid 400.

[ApiController] validates DTOs before the action runs.

Async + CancellationToken everywhere.

Practice exercise#

Your task: Add GET /api/products/search?name=key that returns products whose name contains the search text.

Need a hint?

Where(p => p.Name.Contains(name)) then project to ProductDto.

Show solution

C# Illustrative

1// Controllers/ProductSearchController.cs
2using Microsoft.AspNetCore.Mvc;
3using Microsoft.EntityFrameworkCore;
4

5public record ProductDto(int Id, string Name, decimal Price);
6

7[ApiController]
8[Route("api/products")]
9public class ProductSearchController(AppDbContext db) : ControllerBase
10{
11    [HttpGet("search")]
12    public async Task<IEnumerable<ProductDto>> Search([FromQuery] string name, CancellationToken ct) =>
13        await db.Products.AsNoTracking()
14            .Where(p => p.Name.Contains(name))
15            .Select(p => new ProductDto(p.Id, p.Name, p.Price))
16            .ToListAsync(ct);
17}

Mini quiz#

CRUD API quizMultiple choice Question 1 of 3

Which status code should a successful POST that creates a product return?

Score so far: 0/0

Want more? Practise all ASP.NET Core Web API MCQs · ASP.NET Core Web API interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.

On this page

Related tutorials

Interview questions

In simple words#

Learning objectives#

Explanation#

Syntax#

Code example: ProductsController, driven end to end#

Step-by-step explanation#

Real-world use case#

Common mistakes#

Best practices#

Remember this#

Practice exercise#

Mini quiz#

Related topics#

My notes#