 <p>If time isn't an issue implementing OAuth security may be useful. OAuth uses a public key, and also a secret. The mess is hashed (in most cases) and the server will use the public key + it's copy of the secret to do the same hashing and make sure its result matches the requests. </p> <p>The benefit is you wouldn't need to use HTTPS or POST. Get* REST api methods should be using the HTTP GET method (I'm not sure if being RESTful is your goal, just thought I would point that out). I agree with Mr. Pang, use <a href="http://www.business.com/employees" rel="nofollow noreferrer">http://www.business.com/employees</a>. The query string could contain the list of department ids.</p> <p>For your case the service call wouldn't have the 'accessKey' argument, rather it would become the public key (I imagine) and be used in either the headers, query string, or as a POST param.</p> <p>Some good info on OAuth: <a href="http://www.hueniverse.com/hueniverse/" rel="nofollow noreferrer">http://www.hueniverse.com/hueniverse/</a></p>