 <p>This approach seems a little smelly in that you have deployment concerns leaking into your service contracts and implementation. Given that REST does not expose metadata anyway I don't see a lot of benefit in the different interfaces. </p> <p>I would have thought a behavior or ServiceAuthorizationManager, which examined the message version and disallowed access for REST requests would be a cleaner solution. That way you could have a single service implementation for a single contract and push protocol issues back to where they belong: deployment and configuration.</p>