I wish I could have you look at a project I worked on in the early 2010s in the security industry. We had an architect who went full ham on HATEOS and honestly

I wish I could have you look at a project I worked on in the early 2010s in the security industry. We had an architect who went full ham on HATEOS and honestly it was great. You could point a client at a single root endpoint and it would self-discover every other URL[path] it needed. We relied on RFCs where possible (sometimes drafts when an accepted RFC wasn't required). Everyone got very familiar with RFC 2616[1], link rels, uri templates[2], media types, &c. It required architectural dedication because junior devs would complain that it didn't match what they learned about REST from webdev tutorials. Which is to say, the social hurdles to HATEOS implementations far outweigh the technical hurdles. They'd constantly try hardcode urls and have to be reminded not to do that by the backend folks. From the backend, it was great. We had tremendous flexibility when URLs weren't part of the spec and we were able to tackle hard problems like supporting multiple simultaneous versions quickly and with little lift because of this flexibility. 1. https://www.rfc-editor.org/rfc/rfc2616 https://www.rfc-editor.org/rfc/rfc2616 2. https://www.rfc-editor.org/rfc/rfc6570 https://www.rfc-editor.org/rfc/rfc6570