Building REST APIs With Node.js and Express

1Building a REST API With Node and Express

A REST API built with Node.js and Express is a server that responds to HTTP requests by mapping methods and URL paths to functions that return JSON. Express is a thin web framework for Node that handles routing, request parsing, and middleware so you can focus on your endpoints instead of low-level networking.

REST (Representational State Transfer) is a convention, not a library. It says: model your app as resources, address them with URLs, and act on them with standard HTTP verbs. Express is simply the fastest way to put that convention into practice in JavaScript, which is why it remains one of the most widely used backend frameworks in 2026.

2Why Express for REST APIs

Express earns its popularity by staying out of your way. It ships with almost no opinions, so you assemble exactly the pieces you need and nothing more.

• Minimal core: routing and middleware are all it provides, keeping the mental model small.
• Huge ecosystem: thousands of middleware packages exist for auth, validation, logging, and CORS.
• JSON-native: pairs naturally with JavaScript objects, so serializing responses is trivial.
• Battle-tested: it powers countless production services and has years of stability behind it.
• Easy to learn: a working API fits in a single file, which is ideal for learning the fundamentals.

3Your First Express Server

Getting a server running takes three steps: initialize a project, install Express, and write a handful of lines. The example below creates an app, defines one route, and starts listening on a port.

Run node server.js and visit http://localhost:3000 in a browser to see the response. That is a complete, working HTTP server.

• npm init -y # create package.json
• npm install express # add the framework
• const express = require('express')
• const app = express()
• app.get('/', (req, res) => res.json({ message: 'Hello API' }))
• app.listen(3000, () => console.log('Running on port 3000'))

4Routes and HTTP Verbs

A route ties an HTTP method and a URL path to a handler function. The handler receives a request object and a response object, and its job is to read the request and send a response. Matching verbs to intent is the heart of REST design.

• app.get('/users', ...) # read a collection
• app.get('/users/:id', ...) # read one item by id
• app.post('/users', ...) # create a new user
• app.put('/users/:id', ...) # replace an existing user
• app.patch('/users/:id', ...) # partially update a user
• app.delete('/users/:id', ...) # remove a user

5Middleware: The Request Pipeline

Middleware are functions that run in order on every request before it reaches your route handler. Each one can inspect or modify the request, end the response early, or call next() to pass control along. This pipeline is how Express handles cross-cutting concerns cleanly.

• app.use(express.json()) # parse JSON request bodies into req.body
• app.use(cors()) # allow browser requests from other origins
• app.use(morgan('dev')) # log each request for debugging
• Custom auth middleware: check a token, then call next() or return 401.

6Returning Proper Status Codes

The status code is how clients understand the outcome of a request without parsing the body. Setting the right one is not optional polish — it is part of the API contract. Chain res.status(code).json(data) to send both together.

• 200 OK — a successful GET, PUT, or PATCH.
• 201 Created — a successful POST that made a new resource.
• 204 No Content — a successful DELETE with nothing to return.
• 400 Bad Request — the client sent invalid or missing data.
• 404 Not Found — the requested resource does not exist.
• 500 Internal Server Error — something failed on the server.

7Handling Errors Gracefully

Express recognizes error-handling middleware by its four arguments: (err, req, res, next). Placing one after all your routes gives you a single place to catch failures and return a consistent error shape instead of leaking stack traces to clients.

app.use((err, req, res, next) => {
  console.error(err.stack)
  res.status(err.status || 500).json({ error: err.message })
})

8Structuring a Growing Project

A single file is fine for learning, but real APIs split responsibilities across folders. Separating routing from business logic from data access keeps each file small and testable.

• routes/ — define endpoints and delegate to controllers.
• controllers/ — read the request, call a service, shape the response.
• services/ — hold business logic and talk to the database.
• models/ — describe your data (with an ORM like Prisma or Mongoose).
• middleware/ — reusable auth, validation, and logging functions.

9Best Practices

A few habits separate a toy endpoint from an API you would trust in production.

• Validate every input with a library like Zod or Joi before using it.
• Never trust the client — check auth on protected routes with middleware.
• Use environment variables for secrets and ports, never hardcode them.
• Version your API with a /v1 prefix so you can evolve it without breaking clients.
• Return consistent error shapes so front-end code can handle them uniformly.
• Handle async errors — an unhandled promise rejection can crash the process.

10Key Takeaways

The core of Express REST development fits into a handful of durable ideas.

• An Express API maps HTTP verbs and paths to handlers that return JSON.
• Middleware runs in order — register express.json() before body-reading routes.
• Match verbs to intent and return accurate status codes on every response.
• Centralize error handling with four-argument middleware after your routes.
• Split routes, controllers, and services as the project grows.

11Frequently Asked Questions

Q: Do I need a database to build an Express API? A: No. You can start with an in-memory array to learn routing and status codes, then swap in a database like PostgreSQL or MongoDB once the endpoints work. The route code barely changes.

Q: What is the difference between PUT and PATCH? A: PUT replaces an entire resource with the payload you send, while PATCH updates only the fields you include. Use PATCH when clients should be able to change one attribute without resending the whole object.

Q: How do I handle CORS errors in Express? A: Install the cors package and add app.use(cors()) before your routes. For production, configure it to allow only your front-end's origin rather than every site.

Q: Is Express still relevant in 2026? A: Yes. While Fastify and NestJS have grown, Express remains the default choice for learning and for many production services thanks to its simplicity and enormous ecosystem.