# REST APIs: protect operation order

https://thiago.limaesilvatecnologia.com.br/en/artigos/rest-state-machine/

Published: 2026-09-12

Individually correct endpoints can form an incorrect workflow.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: June 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

An allowed operation may be inappropriate at the current process stage. Review states and transitions alongside route authorization.

## Practical application

Editorial proposal: model a critical journey as a state machine. For a hypothetical order, record actions permitted before and after confirmation, including repetition and concurrency.

## How to verify

Test out-of-order calls and verify consistent state. Record duplicate-request handling. Consumers should recover from failures without legitimate retries causing duplicate changes or unauthorized business transitions.

## Sources

- [OWASP — REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)