Why am I getting no values when using REST api?
This is going to be a fuller answer eventually but for right now it is a partial answer that addresses how to get publicly available data via REST.

The REST API works differently than the PHP or other versions of the API. Some of this is documented and some is not. 

The most important difference between the rest API and the others is that the REST API does not instantiate an authenticated user as the current user in a Joomla! environment. Therefore it cannot use any of the Joomla access controls when determining what data to provide or what actions to allow. Also  because the current user is not an authenticated user, CiviCRM roles (such as the default Authenticated User and Administrator) are not available.  Therefore the only role that is available is Everyone.

However this does not literally mean that everyone (in the sense of the unregistered public) can see.  This is because there must be a contact record with an api_key value and a registered Joomla user associated with that contact. 

This also does not mean that Everyone can see everything. An ACL record still must be created. That is you must create ACL for each kind of data that you want to have accessible to the REST interface. 

For GET the basic approach should be to create a group that contains the records you want to return. Call this, for example, MyGroup. To reiterate: This is not the group of users who have access to the interface, it is the group of users about whom data will be returned.

In the ACL interface click on Manage ACL.  


For Role: Everyone 
Action:View
Type of Data: A group of contacts
Group: MyGroup


These settings will allow you to use the REST interface to return data on one or more users in the MyGroup group, with data based on the URL you craft.

If you have a Joomla front end and you want to access a list of contacts via the rest interface you need to include a number of steps. This includes reading the keys, crafting the URL, and creating the request.


If you have a civicrm.settings.php file you can obtain the site key with the following code:

require_once JPATH_ROOT . '/administrator/components/com_civicrm/helpers/api.php'; 
CivicrmHelperApi::civiInit();
echo CIVICRM_SITE_KEY;



However, if you don't have access to the helper you can just require_once the settings file and that will define the site key constant.


You also need to to access the individual user level API key. Most likely it would make the most sense to  to store that in a file locally and read it in. Call that CIVICRM_API_KEY.
Then you can craft a request url, which will have three parts, the base, the api parameters, and the keys.

// Of course this should be https if possible.
$restbase  = 'http://example.com/jooomla-cms/administrator/components/com_civicrm/civicrm/extern/rest.php?';
$restkeys = '&amp;key='. CIVICRM_SITE_KEY .  '&amp;api_key=' . CIVICRM_API_KEY;
$restvars = 'entity=contact&amp;action=get&amp;json={"sequential":1,"return":"first_name"}';

// Make the request
$http = new JHttp();
$return = $http-&gt;get($restbase2 . $restvars  . $restkeys);

// Do something with the data
$body = $return-&gt;body;
$values = json_decode($body)-&gt;values;

foreach ($values as $value)
{
    echo '&lt;div&gt;' . htmlspecialchars($value-&gt;first_name) . ' &lt;/div&gt;';
}



Some notes

There are many combinations of actions and entities which cannot be created in the ACL settings. 

Depending on what you are envisioning you may want to create a Joomla user to be the one that provides access or you could register a user for each application that will be allowed to access publicly available data via the REST API.  

These include most post and delete actions. In these cases there is sometimes checking of specific Joomla permissions such as access Civicrm but it does not work as expected. At least at this point the authorization process always returns false unless you have given the public permission to do these things via Joomla ACL. Not a good idea. 

Update

I sent a pull request for a fix for this so that now permissions will be checked. You can apply this as a patch and it will work the way the documentation says (or at least it has been for me -- would love a few people to test it).