title: JSON/REST over HTTPS + WS Security possible?
body: <p>We have a new security person at the office doing some penetration tests on the APIs I've put in place.</p>
  
  <p>He pointed out that we are not using WS Security on top of the JSON/REST service we are exposing over HTTPS to the outside world.</p>
  
  <p>My question is, 
  <strong>is it really possibly to combine WS Security with JSON/REST services?</strong></p>
  
  <p>To my knowledge, WS Security have nothing to do with JSON/REST service at all.. It is used for regular Web services, embedding extra security elements in the SOAP envelope. 
  But, we are not using SOAP for the APIs... </p>