Django REST Framework

They differ in the value that stands for the related object: PrimaryKeyRelatedField uses its pk, SlugRelatedField a named unique field, HyperlinkedRelatedField its detail URL, and StringRelatedField str(obj), which is output-only because that field is always read-only.

A plain Serializer declares every field and needs its own create() and update(); a ModelSerializer builds fields and validators from a model through Meta and implements both methods. Choose a plain Serializer when the payload is not one model.

is_valid() runs the whole validation pipeline on the data passed as data=, stores either validated_data or errors, and returns a boolean. With raise_exception=True an invalid payload raises serializers.ValidationError, which DRF's exception handler turns into a 400 response carrying the errors.

Meta.fields (or exclude) chooses which model fields exist on the serializer; read_only_fields marks some as output-only; extra_kwargs passes any other field argument. Both shortcuts apply only to generated fields and are ignored for fields declared explicitly on the class.

validate_<field_name>(value) checks one field after its own conversion and validators; validate(attrs) checks rules across fields after every field passed and serializer-level validators ran. Both return the value, and a ValidationError in validate() lands under non_field_errors unless given a dict.

GenericAPIView adds queryset, serializer_class, lookup_field and helpers like get_queryset(), get_serializer() and get_object(). Five mixins supply list(), create(), retrieve(), update() and destroy(); concrete classes such as ListCreateAPIView bind get() and post() to them.

Both give a view DRF's Request and Response, content negotiation, authentication, permission and throttle checks, and API exception handling. APIView is a class with get()/post() methods and policy attributes; @api_view(['GET']) wraps a function into an APIView subclass, with policy decorators.

request.query_params is DRF's name for Django's request.GET. request.data is the body parsed by the view's parsers from its Content-Type, for POST, PUT and PATCH alike, JSON included; Django's request.POST holds only form-encoded POST data.

A ViewSet defines actions such as list() and retrieve() instead of get() and post() handlers; as_view() or a router binds HTTP methods to them. ModelViewSet provides all six CRUD actions; ReadOnlyModelViewSet provides only list() and retrieve().

Override perform_create(self, serializer) and call serializer.save(requester=self.request.user). CreateModelMixin.create() still validates input, calls the hook, and returns 201, so only the save step changes and none of the response plumbing is copied.

Authentication classes identify the caller; permission classes decide access. DRF tries each class in order, and the first returning (user, auth) sets request.user and request.auth: for TokenAuthentication, the token's user and Token instance; otherwise AnonymousUser and None.

DRF's default permission is AllowAny, so an unconfigured view accepts anonymous requests. Set DEFAULT_PERMISSION_CLASSES to IsAuthenticated in REST_FRAMEWORK; a view's own permission_classes then replaces that list rather than adding to it.

DRF throttles nothing by default: list the classes in DEFAULT_THROTTLE_CLASSES and give 'anon' and 'user' rates like '100/day' in DEFAULT_THROTTLE_RATES. A throttled request gets 429 with a Retry-After header and a 'Request was throttled.' detail.

List TokenAuthentication and SessionAuthentication in DEFAULT_AUTHENTICATION_CLASSES and add rest_framework.authtoken. Only SessionAuthentication enforces CSRF, because browsers attach session cookies automatically, while a token in the Authorization header must be added by the client.

has_permission runs on every request before the handler and sees only the request and view; has_object_permission sees a model instance and runs only when check_object_permissions() is called, which generic views do inside get_object().

DRF catches APIException subclasses raised in a view and returns a Response with the class's status_code and a body of {"detail": message}. Django's Http404 and PermissionDenied are mapped to 404 and 403; other exceptions propagate as a 500.

A DRF generic view passes its queryset through each class in filter_backends: DjangoFilterBackend (django-filter) handles field filters like ?remote=true, SearchFilter handles ?search= over search_fields, and OrderingFilter handles ?ordering= limited to ordering_fields.

DRF paginates nothing by default: set DEFAULT_PAGINATION_CLASS and PAGE_SIZE, or pagination_class on a view. PageNumberPagination reads ?page=N and returns count, next, previous and results; a page beyond the end is a 404.

Write a function (exc, context) that calls rest_framework.views.exception_handler, reshapes response.data into your envelope, and set it as EXCEPTION_HANDLER. It never sees responses a view returns itself, errors outside DRF views, or unhandled exceptions it returns None for.

OrderingFilter's ordering_fields is the whitelist for ?ordering=. Unset, it allows every readable serializer field; 'all' allows every concrete model field and annotation. An explicit list stops clients sorting by hidden or unindexed columns.

Subclass APITestCase, call self.client.force_authenticate(user=user), POST the payload with format='json', then assert status 201, the key fields of response.data, and that the database row exists with the right owner.

DRF 3.18 still ships SchemaGenerator, AutoSchema, generateschema and get_schema_view, but its documentation deprecates them in favour of third-party packages and recommends drf-spectacular for OpenAPI 3. CoreAPI schema support was already removed in 3.17.0.

The browsable API is an HTML renderer that shows one endpoint at a time, live, to a person in a browser acting as the current user. Generated OpenAPI documentation is a machine-readable description of every operation that partners and tools can use without your server.

format='json' makes APIClient render the body with JSONRenderer and send Content-Type application/json. Without it, DRF uses TEST_REQUEST_DEFAULT_FORMAT, which defaults to 'multipart', so nested dicts and None cannot be sent.

APIRequestFactory only builds an HttpRequest; you call the view directly, so there is no URL routing or middleware. Use it to unit-test a view class; you must map viewset actions, pass URL kwargs, authenticate with force_authenticate(request, ...) and render the response yourself.