title: RESTful API without ID in the URL
body: <p>I have been discussing the best way of doing this with one of my colleagues</p>
  
  <p>Here's an example scenario:</p>
  
  <p>I'm trying to GET all orders for a <code>Customer</code> with ID of 1234.</p>
  
  <p>Consider the following endpoint:</p>
  
  <blockquote>
    <p>/customer/orders  </p>
  </blockquote>
  
  <p>With a GET request, with the following header:</p>
  
  <blockquote>
    <p>Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==</p>
  </blockquote>
  
  <p>With the <code>Authorization</code> header, our auth mechanism identifies this request as for a Customer with ID 1234 and our service returns the required orders.</p>
  
  <p>He is trying to persuade me this is right, because one logged in Customer, would only ever request <em>their</em> orders (in this case, the orders belonging to customer 1234) - so passing the ID in the URL is unnecessary.
  However.... To me, that isn't RESTful (I may be wrong)</p>
  
  <p>In my opinion, it should be like this:.</p>
  
  <blockquote>
    <p>/customer/1234/orders  </p>
  </blockquote>
  
  <p>With the header (As an example)  </p>
  
  <blockquote>
    <p>Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==</p>
  </blockquote>
  
  <p>With the Authorization header, we verify the user has permission to retrieve those orders... If so, return them, else, return a 401</p>
  
  <p>My question is, which is the preferred method?</p>
  
  <p>I can certainly see benefits of the first way, but in the interest of keeping our api RESTful, my heart says to go with the second way...</p>