title: REST APIs and message level security
body: <p>I need to implement message level security in a REST API and have some concerns and questions. I found the answer here: 
  <a href="https://stackoverflow.com/questions/9869828/message-level-security-in-rest-web-services">Message Level Security in Rest Web services</a></p>
  
  <p>only partially helpful. </p>
  
  <p>We currently support standard SSL transport security and several authentication methods including:</p>
  
  <ul>
  <li>Basic http auth (required by some network equipment services that
  talk to our API's)</li>
  <li>HMAC with pre-shared secrete key in both SHA1 and    SHA256 flavors.</li>
  <li>Client identity certs sent @ the TLS level. </li>
  <li>SAML 2.0</li>
  </ul>
  
  <p>Why we need message level security because:</p>
  
  <ul>
  <li>Customer industries include health care, financial and government, among others, and they often frown on SSL only.</li>
  <li>Need to guarantee end to end security. Through reverse proxies, SSL accelerators, etc... </li>
  <li>Some data passed through the services will include very sensitive data. </li>
  <li>Need to have a good answer for customers that insist that SOAP's WS-* security standards are  "Enterprise strength" web services and REST APIs are not.</li>
  </ul>
  
  <p>My initial thought is to use an PKCS#7 envelope, as an option, if client applications understand how to process enveloped responses. </p>
  
  <p>I want client applications to tell the API that they want a secured response or tell the API that the message they are POSTing or PUTing is secured.</p>
  
  <p>My real question is, should this be communicated through a media type? E.g.:</p>
  
  <ul>
  <li>Content-Type: application/vnd.resourcetype1+json+pkcs7</li>
  <li>Content-Type: txt/csv+pkcs7</li>
  </ul>
  
  <p>i don't want to loose information on the media type that is enveloped. </p>
  
  <p>It gets complicated as in some cases the signature is enough. Others require encryption as well. The term "pkcs7" is vague as to how the envelope is constructed. </p>
  
  <p>I want the client and server to tell each other the type of content they are sending and the type of content they understand through standard HTTP headers.</p>