This suggestion sounds right to me. Or there is the possibility to throw an "InvalidArgumentException" in case of invalid variant ID (which would then produce 404). It's up to you, some people like exceptions more than nulls (I'd probably expect returning null in this case).