I'm designing an API following the HATEOAS / RESt principles. Yet I'm not sure about this basic point: identification of resource.
Suppose this url: /images which exposes all the images uploaded by an user (to this user).
Suppose I use an oauth access token for the authentication purpose, the content of /images will vary based on the Authorization header.
Does this break the identification of resource concept ?
No. A resource does not have to be static to be restful. Imagine a webservice that provides time-of-day:
Http://www.myservice.com/current-time/
Nothing in the rest playbook would demand that this not work as expected. The case with the photos is that your service is returning a resource represented based on info set in the request--filtering out all non-user owned photos by auth header. Your still returning the same general thing, a collection of photos.
Not much different than saying with the response type header you want a json representatio vs an xml representation returned.
Things get fishy when you switch results completely, like one person gets a collection of images while another is provided last weeks transcript of Glee at the same resource location.
来源：https://stackoverflow.com/questions/12718772/rest-api-identification-of-resource-and-content-varying-based-on-authentication