title: GET vs. POST when parameters are required
body: <p>I have an endpoint in an API I'm currently writing that is meant to return a filtered list of a user's Facebook friends. Users authenticate to Facebook on the mobile app calling this endpoint, so the <code>access_token</code> is stored in the mobile app, not in the API's database.</p>
  
  <pre><code>Endpoint: /users/:id/friends
  Parameters: access_token (the requested user's Facebook access_token)
  Return: A list of the user's Facebook friends who have the app installed
  </code></pre>
  
  <p>The action isn't modifying any data; it is simply returning the filtered list. However, since an extra parameter (<code>access_token</code>) is required, it means that a GET request would not conform with the API's routing structure, since no other GET routes have an extra parameter appended to them.</p>
  
  <p>Which of the following HTTP requests is appropriate for this action?</p>
  
  <pre><code>GET /users/:id/friends/:access_token
  GET /users/:id/friends?access_token=&lt;token&gt;
  POST /users/:id/friends (passing 'access_token' as a POST param)
  </code></pre>