How to PUT multiple resources via a REST API - json

Question

I am trying to figure out the best way of adding multiple users to a group via a REST API.
Right now, I am thinking this is the best way of adding a single user at a time:
PUT /groups/123/{userID}
Then, to remove the user from the group:
DELETE /groups/123/{userID}
But how would I add multiple users to the group at the same time? Would this be the best way?
PUT /groups/123
Content body as an array:
[
"user1",
"user2",
"user3"
]
...and to remove the users from the group, I would do the same thing via a DELETE request.
Is there anything "wrong" with this setup, or would there be a better, more "industry standard" way of doing this?

Answer 1

How to PUT multiple resources via a REST API
You don't do that - each request in HTTP has one-and-exactly-one target resource; the semantics of the PUT request are that the message body of the request is a replacement representation for the resource.
Resources are generalizations of documents.
It's entirely reasonable to have a document that is a representation of the members of some group.
PUT /groups/123
[
"user1",
"user2",
"user3"
]
What this request means is "replace your copy of /groups/123 with this copy". It's purely a document editing command.
The useful work - like actually making changes to the master group membership list, is a side effect of making your copy of the document look like the provided copy. See Webber 2011.
In this style, "removing" a user from the group would look like another edit to the /groups/123 document
PUT /groups/123
[
"user1",
"user3"
]
Of course, remote authoring semantics aren't required; you could instead do:
POST /groups/123
Please remove user1
or
POST /groups/123
action=addUser&id=user4
to remove the users from the group, I would do the same thing via a DELETE request
Careful - DELETE (like PUT) means something specific in HTTP, and that may not be what you mean.
Relatively few resources allow the DELETE method
The semantics of DELETE belong firmly in the transfer documents over a network domain, not in the "manage users and groups" domain.