I have been discussing the best way of doing this with one of my colleagues
Here's an example scenario:
I'm trying to GET all orders for a Customer with ID of 1234.
Consider the following endpoint:
/customer/orders
With a GET request, with the following header:
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
With the Authorization header, our auth mechanism identifies this request as for a Customer with ID 1234 and our service returns the required orders.
He is trying to persuade me this is right, because one logged in Customer, would only ever request their orders (in this case, the orders belonging to customer 1234) - so passing the ID in the URL is unnecessary. However.... To me, that isn't RESTful (I may be wrong)
In my opinion, it should be like this:.
/customer/1234/orders
With the header (As an example)
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
With the Authorization header, we verify the user has permission to retrieve those orders... If so, return them, else, return a 401
My question is, which is the preferred method?
I can certainly see benefits of the first way, but in the interest of keeping our api RESTful, my heart says to go with the second way...