REST API: Validating request params in GET request?

Question

If you have query string param secondaryId on a GET endpoint of a REST API which searches a resource by that secondaryId , should you apply the same validation on that query string parameter that you would apply to the secondaryId in a CREATE or UPDATE?. For instance, if secondaryId can only be 10 characters long, should you validate the secondaryId in the querystring param of a GET request?

To me this seems out of place in the context of GETting a resource, but I can't find any resources online that mention this explicitly.

Answer 1

From the perspective of HTTP, if somebody tries to GET something using a url that doesn't point to anything, it simply means that that resource doesn't exist.

Irrespective of how the id is validated, or what you do with it... you probably just want to return 404 Not Found .