In a REST API, after authentication a user receives an AccessToken, which is then sent along with every request. Server-side, the token is mapped to a UserID of that user.
Let’s say I address the messages resource like this:
GET /user/123/messages
vs. accessing it in this way:
GET /messages/
and pulling the UserID from the AccessToken header.
Which way is more RESTful? I tend towards the first – it seems more readable and cachable, but are there other reasons as well?
The first identifies a unique Resource, the second does not. If the meaning of the second URI depends on additional information (the session token), it doesn’t identify anything. So only the first approach is RESTful.