Design the resource before writing routes
A REST API should expose resources through predictable URLs and use HTTP methods consistently. For a product resource, clients might list products with GET, create with POST, update with PATCH and delete with DELETE.
Separate the layers
The HTTP layer should validate requests and produce responses. Service code should implement business rules, while repository code should manage database persistence. This separation makes individual parts easier to test.
Return predictable responses
Use appropriate status codes and consistent JSON structures. Missing resources, validation errors and authorization failures should be distinguishable. Never return internal stack traces to API clients.
Project exercise: build a product CRUD API with validation, SQLite or another relational database, automated tests and clear error responses.