You're not asking, "Does this card exist?", and sending a 404 if you have no record. Doesn't this depend on the nature of the REST API? (Though putting a credi

You're not asking, "Does this card exist?", and sending a 404 if you have no record. Doesn't this depend on the nature of the REST API? (Though putting a credit card number on the path doesn't seem like a good practice.)