> For the complete documentation index, see [llms.txt](https://docs.elentra.org/api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elentra.org/api/elentra-api-standards/routing-and-parameters/common-mistakes/get-admissions-file-review-file-rubric-score-delete-id.md).

# \[GET] /admissions/file-review/file/rubric-score/delete/{id}

{% tabs %}
{% tab title="Critique" %}

* `file` and `rubric-score` are singular. However, they should be plural, because this URI is referring to a set of rubric scores associated with a particular file.
* `file-review` is not a resource. It is a namespace, so this is okay. But multiple nested namespaces like `/admissions/file-review/file-approval/...` is a bad practice.
* The wrong HTTP method is being used. The endpoint deletes rubric scores, but the HTTP method is GET.
* The actual verb "delete" is in the route, which should instead be captured by the HTTP method.

{% hint style="danger" %}
This particular URI is also an example of a Cross-site Request Forgery (XSRF) vulnerability. An attacker can insert the URL in an `<img>` tag, put it on a external website, and a logged-in user would then unknowingly trigger the rubric score to be deleted.
{% endhint %}
{% endtab %}

{% tab title="Suggestion" %}
{% hint style="info" %}
**Final Suggestion**

\[DELETE] `/admissions/file-review/file/{file}/rubric-scores/{score_id}`
{% endhint %}

* More succinct because it is clear which file the score belongs to.
* This allows for checking permissions to access the file.
  {% endtab %}
  {% endtabs %}