Build a REST API with Node and Express, step by step

What are Node and Express, in one paragraph each?

Node.js is JavaScript outside the browser. It runs the same language you use in pages, but with access to files, networks and processes — so it can *be* a server, not just talk to one. When you run node server.js, Node executes your file and keeps it alive, listening for network requests.

Express is a small library that makes writing that server pleasant. Node's built-in HTTP module can answer requests, but you end up hand-parsing URLs and methods with if statements (the previous tutorial showed exactly that). Express replaces the if forest with a routing table: app.get('/tasks', handler) means "when a GET request arrives for /tasks, run this function." Everything else in this tutorial is detail around that one idea.

What are we building?

A tasks API — the classic first backend, because it exercises every REST operation on one simple resource:

The data lives in a plain JavaScript array in memory — it resets when the server restarts, which is *fine* for learning and is exactly why real APIs add databases (the subject of the Node course's next module). By the end, you will have made all five kinds of REST conversation happen against a server on your own machine.

Step 1 — Set up the project

Open a terminal, make a folder, and initialise it:

mkdir tasks-api && cd tasks-api
npm init -y
npm install express

npm init -y creates a package.json with default answers. npm install express downloads Express into node_modules and records it as a dependency. At the time of writing, a plain npm install express installs Express 5.x (5.3.0 in the verified run below) — the code in this tutorial is written for the version you install, so do not pin an old express@4 from a dated blog post.

Expected result: a package.json listing express under dependencies, and no errors. You need Node.js installed — any recent version works; the run below used v24.22.1.

Step 2 — The server skeleton

Save this as server.js — it is the foundation everything else bolts onto:

const express = require('express');
const app = express();
const PORT = 3000;

app.use(express.json());

app.listen(PORT, () => console.log(`API running at http://localhost:${PORT}`));

Line by line:

• require('express') loads the library; express() creates your application.
• app.use(express.json()) is the line beginners most often forget. It installs middleware that reads incoming JSON request bodies and turns them into req.body. Without it, req.body is undefined and every POST and PUT breaks — it appears in the mistakes section for a reason.
• app.listen(PORT, ...) starts the server and prints a confirmation. Your routes will be added between the middleware line and this line.

Step 3 — GET: read all and read one

Add the two read routes after the express.json() line:

// In-memory data (resets on restart — fine for a tutorial)
let tasks = [
  { id: 1, title: 'Learn Express routing', done: true },
  { id: 2, title: 'Build a REST API', done: false },
];

// READ all
app.get('/tasks', (req, res) => {
  res.json(tasks);
});

// READ one
app.get('/tasks/:id', (req, res) => {
  const task = tasks.find(t => t.id === Number(req.params.id));
  if (!task) return res.status(404).json({ error: 'Task not found' });
  res.json(task);
});

The patterns to absorb:

• res.json(anything) sets the JSON content header and sends the body — the Express shortcut for what took several lines with raw Node.
• :id in the path is a route parameter. Express puts it in req.params.id — as a *string*, always. Number(req.params.id) converts it, because 1 === "1" is false and the lookup would 404 every time without the conversion.
• The 404 branch returns before the success line. Forgetting the return is a classic crash: Express would try to send two responses for one request.

Step 4 — POST: create, with validation

// CREATE
app.post('/tasks', (req, res) => {
  const { title } = req.body;
  if (!title) return res.status(400).json({ error: 'Title is required' });
  const newTask = {
    id: tasks.length ? Math.max(...tasks.map(t => t.id)) + 1 : 1,
    title,
    done: false
  };
  tasks.push(newTask);
  res.status(201).json(newTask);
});

Three REST ideas in one route: the 201 Created status (not 200 — something new exists), 400 Bad Request when required input is missing (validate *before* touching data), and the server assigning the id (the client sent only a title; the response reveals the new resource, id included). The id line takes the highest existing id plus one, or 1 for an empty list — simple, predictable, good enough until a database takes over.

Step 5 — PUT: update

// UPDATE
app.put('/tasks/:id', (req, res) => {
  const task = tasks.find(t => t.id === Number(req.params.id));
  if (!task) return res.status(404).json({ error: 'Task not found' });
  if (req.body.title !== undefined) task.title = req.body.title;
  if (req.body.done !== undefined) task.done = req.body.done;
  res.json(task);
});

The update merges only the fields the client sent — !== undefined checks (not truthiness checks) so that setting done: false or title: "" still works. It answers 200 with the updated task, the standard "here is what you now have" response.

Step 6 — DELETE: remove

// DELETE
app.delete('/tasks/:id', (req, res) => {
  const task = tasks.find(t => t.id === Number(req.params.id));
  if (!task) return res.status(404).json({ error: 'Task not found' });
  tasks = tasks.filter(t => t.id !== task.id);
  res.json({ message: 'Task deleted' });
});

filter builds a new array without the deleted task and reassigns it — which is why tasks is declared with let, not const. Deleting something that does not exist is a 404, same as reading it: the resource is addressed the same way for every method, exactly as REST prescribes.

The complete server.js is the six snippets above assembled in order: requires, app, express.json(), the data array, the five routes, then app.listen. Sixty lines, five endpoints.

Step 7 — Run it and test every endpoint with curl

Start the server:

node server.js

Expected output (this exact line):

API running at http://localhost:3000

Leave that terminal running. Open a second terminal and talk to the API with curl. Every pair below is the actual output of a real run (Node.js v24.22.1, Express 5.3.0) — yours should match exactly.

List all tasks:

curl http://localhost:3000/tasks

[{"id":1,"title":"Learn Express routing","done":true},{"id":2,"title":"Build a REST API","done":false}]
HTTP 200

Read one task:

curl http://localhost:3000/tasks/1

{"id":1,"title":"Learn Express routing","done":true}
HTTP 200

Ask for what does not exist — the 404 arrives *with* a JSON body explaining it:

curl http://localhost:3000/tasks/99

{"error":"Task not found"}
HTTP 404

Create a task — -X POST sets the method, -H sets the JSON content header, -d sends the body:

curl -X POST http://localhost:3000/tasks \
  -H "Content-Type: application/json" \
  -d '{"title":"Test with curl"}'

{"id":3,"title":"Test with curl","done":false}
HTTP 201

Create with missing input — validation fires before anything is stored:

curl -X POST http://localhost:3000/tasks \
  -H "Content-Type: application/json" \
  -d '{}'

{"error":"Title is required"}
HTTP 400

Update the new task:

curl -X PUT http://localhost:3000/tasks/3 \
  -H "Content-Type: application/json" \
  -d '{"done":true}'

{"id":3,"title":"Test with curl","done":true}
HTTP 200

Delete it:

curl -X DELETE http://localhost:3000/tasks/3

{"message":"Task deleted"}
HTTP 200

List again — the collection is back to the original two, proving the delete really removed it:

curl http://localhost:3000/tasks

[{"id":1,"title":"Learn Express routing","done":true},{"id":2,"title":"Build a REST API","done":false}]
HTTP 200

Eight requests, five endpoints, four status codes — the complete REST conversation, against a server you wrote.

What did Express actually do for you?

Compare with the raw-Node server from the previous tutorial: there, every route was an if on req.method and the URL, the body had to be assembled from data chunks by hand, and headers were set manually. Express absorbed all of that:

• Routing table instead of if-chains. app.get('/tasks/:id', ...) declares the method, the path pattern and the handler in one line — and route parameters arrive parsed.
• Body parsing as middleware. One app.use(express.json()) line handles every JSON body on every route, instead of chunk-assembly code in each handler.
• Response helpers. res.json() and res.status(n).json() replace manual header-setting and stringifying.

That is the honest pitch for Express: not magic, just the repetitive HTTP plumbing factored out so your code is the routes, the data and the rules.

Common mistakes

• Forgetting app.use(express.json()). req.body is undefined, destructuring it crashes or every POST returns 400 for the wrong reason. The middleware line must come before the routes that use it.
• Skipping Number(req.params.id). Route parameters are strings; tasks.find(t => t.id === "1") never matches, so every :id lookup 404s. Convert, then compare.
• Installing express@4 from an old tutorial. A plain npm install express now gives you 5.x; pinning version 4 from a dated blog post buys you different behaviour in edge cases for no benefit. Install plain express and write for what you installed.
• "Port 3000 is already in use" (EADDRINUSE). A previous node server.js is still running in another terminal. Stop it (Ctrl+C) or change PORT — do not stack servers on the same port and debug phantom responses.
• Forgetting return after sending an error. Without it, the handler keeps running and Express throws "Cannot set headers after they are sent" when the success line also responds. Send one response per request, then stop.

Frequently asked questions