What is the "RESTful" way of adding non-CRUD operations to a RESTful service? Say I have a service that allows CRUD access to records like this:
GET /api/car/123 <- Returns information for the Car object with ID 123
POST /api/car <- Creates a new car (with properties in the request)
PUT /api/car/123 <- Updates car 123 (with properties in the request)
DELETE /api/car/123 <- Deletes car 123
POST /api/car/123/wheel/ <- Creates a wheel and associates it to car 123
If I want to change the car's color, I would simply POST /api/car/123 and include a POST variable for the new color.
But let's say I want to purchase a car, and that operation is more complicated than simply updating a "user" record's "owned car" property. Is it RESTful to simply do something like POST /api/car/123/purchase, where "purchase" is essentially a method name? Or should I use a custom HTTP verb, like PURCHASE instead of POST?
Or are non-CRUD operations completely outside the scope of REST?