Implement permissions via relationships?

[jlangley]

@morris

if I want to operate on relationships using their ids, when only resource ids are exposed to the client, there is no way to do so under the current spec.

If you’d said: “if I want to operate on resources using their ids”
I’d reply: There’s nothing in the spec that prevents you from doing that. If you do then your API isn’t RESTful, but REST compliance might not be important to you.

But I’m not clear exactly why you say “relationships” here.

@morris

But I may have hit a use case where relationships have relationships to other relationships or resources,

Then I think you do need to promote your relationships to resources.

@morris

I don’t know if my need to hide relationships for permissions is a general need that REST APIs have or if I have just messed up somewhere.

Are you building an API to manage permissions on resources outside the API, or an API to manage resources which also allows permissions for those resources to be managed through the same API?