The HTTP PUT method is semantically correct for updating an existing resource at a specific URI. The @PUT annotation defines the HTTP method, and @Path(“/{id}”) allows the customer ID to be captured from the URL path segment, making it the standard and most appropriate choice for a RESTful update operation.

JAX-RS resource classes are managed per-request by the JAX-RS runtime by default, not by CDI. If the resource class lacks a CDI scope annotation (like @RequestScoped), CDI will treat it as a dependent pseudo-scoped bean. A new instance of the resource class, and therefore a new instance of any dependent-scoped bean injected into it, is created for every JAX-RS method invocation. Adding a scope annotation like @RequestScoped to the JAX-RS resource class brings it under CDI management and aligns its lifecycle with the HTTP request.

The @RolesAllowed annotation is the standard, declarative way to specify which security roles are permitted to execute a method or class in the Java EE Security API. It is simple, effective, and the correct choice for this requirement. @DeclareRoles is used to define roles available to the application but does not itself restrict access. @RunAs is for setting a propagated security context, and @Secure is not a standard Java EE annotation.

The Cache-Control header with the max-age directive is the modern, preferred way to specify caching behavior in HTTP/1.1. Setting `max-age=5` instructs the client that the response is fresh for 5 seconds. During this window, the client can use its cached copy without contacting the server, perfectly matching the requirement of updating every 5 seconds. While Expires does a similar job, it uses an absolute date/time and is considered less flexible than max-age.

The Invocation.Builder, obtained from a WebTarget, provides a .header(String name, Object value) method specifically for adding headers to a single request. This is the most straightforward and appropriate method for adding a custom header to one specific invocation. A ClientRequestFilter is better for adding headers globally to all requests from that client. @HeaderParam is for server-side resources to extract headers, not for client-side construction.

The property bag on the ContainerRequestContext (and by extension, available in the ContainerResponseContext) is the standard, request-scoped mechanism provided by JAX-RS for passing information between filters and resources during the processing of a single request. It is thread-safe for that request and does not have the pitfalls of managing a ThreadLocal manually. Using a CDI bean is also valid but is a heavier-weight solution for a simple string value.

While not a pure JAX-RS annotation, injecting the @Context HttpServletRequest provides access to the underlying Servlet API, including its getInputStream() method. This low-level InputStream allows for efficient, streaming processing of the entire request entity body, which is essential for handling large file uploads without buffering them entirely in memory. @FormParam is for multipart/form-data, and the other options are not suitable for accessing the raw entity stream.

JAX-RS implementations like Jersey provide built-in MessageBodyWriter providers for JSON-P types (JsonObject, JsonArray, JsonStructure). When a method returns a JsonObject and is annotated with @Produces(MediaType.APPLICATION_JSON), the JAX-RS runtime will automatically locate the appropriate writer to serialize the JsonObject to a JSON string and set the correct Content-Type header. This is the most direct and idiomatic approach.

While 400 Bad Request is a general-purpose client error, HTTP 422 Unprocessable Entity (from RFC 4918) is more specific and appropriate for REST APIs. It indicates that the server understands the content type and syntax of the request entity (so it’s not a 400), but it was unable to process the contained instructions due to semantic errors—like a business rule violation (negative quantity). This provides a clearer signal to the client than the more generic 400.

The HTTP PUT method is semantically correct for updating an existing resource at a specific URI. The @PUT annotation defines the HTTP method, and @Path(“/{id}”) allows the customer ID to be captured from the URL path segment, making it the standard and most appropriate choice for a RESTful update operation.0