The code from my article on building RESTful web services with Python and the Flask microframework (this fork is Python 3 compatible). See the article here: http://blog.miguelgrinberg.com/post/designing-a-restful-api-with-python-and-flask

rest-server.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import unicode_literals

import sys

from flask import Flask, jsonify, abort, request, make_response, url_for
from flask.ext.httpauth import HTTPBasicAuth


if sys.version_info[0] < 3:
    unicodetype = unicode
else:
    unicodetype = str

app = Flask(__name__, static_url_path="")
auth = HTTPBasicAuth()

fields = {
    'title': unicodetype,
    'description': unicodetype,
    'done': bool
}

tasks = [
    {
        'id': 1,
        'title': 'Buy groceries',
        'description': 'Milk, Cheese, Pizza, Fruit, Tylenol',
        'done': False
    },
    {
        'id': 2,
        'title': 'Learn Python',
        'description': 'Need to find a good Python tutorial on the web',
        'done': False
    }
]

users = {
    'chris': 'restapi',
}


def _filter_tasks(tasks, task_id):
    return [t for t in tasks if t['id'] == task_id]


@auth.get_password
def get_password(username):
    return users.get(username)


@auth.error_handler
def unauthorized():
    return make_response(jsonify({'error': 'Unauthorized access'}), 403)
    # return 403 instead of 401 to prevent browsers from displaying the default
    # auth dialog


@app.errorhandler(400)
def bad_request(error):
    return make_response(jsonify({'error': 'Bad request'}), 400)


@app.errorhandler(404)
def not_found(error):
    return make_response(jsonify({'error': 'Not found'}), 404)


def make_public_task(task):
    new_task = {}

    for field in task:
        if field == 'id':
            new_task['uri'] = url_for('get_task', task_id=task['id'],
                                      _external=True)
        else:
            new_task[field] = task[field]

    return new_task


@app.route('/todo/api/v1.0/tasks', methods=['GET'])
@auth.login_required
def get_tasks():
    return jsonify({'tasks': [make_public_task(t) for t in tasks]})


@app.route('/todo/api/v1.0/tasks/<int:task_id>', methods=['GET'])
@auth.login_required
def get_task(task_id):
    task = _filter_tasks(tasks, task_id)

    if len(task) == 0:
        abort(404)

    return jsonify({'task': make_public_task(task[0])})


@app.route('/todo/api/v1.0/tasks', methods=['POST'])
@auth.login_required
def create_task():
    if not request.json or 'title' not in request.json:
        abort(400)

    task = {
        'id': tasks[-1]['id'] + 1,
        'title': request.json['title'],
        'description': request.json.get('description', ""),
        'done': False
    }
    tasks.append(task)
    return jsonify({'task': make_public_task(task)}), 201


@app.route('/todo/api/v1.0/tasks/<int:task_id>', methods=['PUT'])
@auth.login_required
def update_task(task_id):
    task = _filter_tasks(tasks, task_id)

    if len(task) == 0:
        abort(404)

    rdata = request.json

    if not rdata or not isinstance(rdata, dict):
        abort(400)

    for name, type_ in fields.items():
        value = rdata.get(name)

        if value and not isinstance(value, type_):
            abort(400)

        task[0][name] = value if value is not None else task[0][name]

    return jsonify({'task': make_public_task(task[0])})


@app.route('/todo/api/v1.0/tasks/<int:task_id>', methods=['DELETE'])
@auth.login_required
def delete_task(task_id):
    task = _filter_tasks(tasks, task_id)

    if len(task) == 0:
        abort(404)

    tasks.remove(task[0])
    return jsonify({'result': True})


if __name__ == '__main__':
    app.run(debug=True)