rest - What information should be sent on body? -

i've been reading microservices , have doubts what's data should sent on body, , what's data should populated in server (by means of id).

for example, imagine have real estate agency, , domain models agent, client , house. imagine agent submit deal has to:

• log in agency's system account
• create client's profile in system
• fill transaction form
  • client data
  • house sold
• click on submit (this submits data sales service)

now question is, if sales service requires fields client's first , last name, client's contacts, house's address , on, should we:

• send required data browser, or id of house , client , service handle rest?
• if have restriction in system says "you can sell houses clients", how guarantee in sales service agent selling house client (how can trust data comes browser)?

thanks in advance.

send required data browser, or id of house , client , service handle rest?

typically, if house , client aren't changing in request, send ids, e.g.

{   sale: {     price: "100000.00",     houseid: 123,     clientid: 456   } } 

if have restriction in system says "you can sell houses clients", how guarantee in sales service agent selling house client (how can trust data comes browser)?

the answer can't trust data client. if incoming sale request, have verify on server. typically have guard clauses or pre-filters check operation against constraints (along other stuff cleansing data , checking user's permission).