How do you decide what belongs in the route, query string, or body of an API request?

In production I make binding sources explicit where inference would be surprising and keep one authoritative source for each value. If /tenants/{tenantId}/orders/{id} conflicts with a body id, I reject the mismatch or omit that body field; I never let the body silently override the authorized route scope. Ownership, tenant, actor, and audit values come from trusted server context even if a client submits lookalike fields. I define repeated-query and array syntax, case rules, maximum URL and body sizes, supported filter operators, unknown-field behavior, and canonical ordering where signed URLs or caches depend on it. Sensitive search criteria may require a body and stricter logging controls, but POST is not used merely to bypass careful resource design. OpenAPI and contract tests verify binding from route, query, header, body, and multipart sources, including malformed values, duplicate keys, route/body disagreement, oversized requests, and old clients. The result should remain obvious to a human reading the request and predictable to proxies, caches, generated clients, authorization code, and telemetry.