I want to know because I was thinking of doing this in a side project, but I fear my proprietary functionality could be exposed.
``` { "count": 1, "results": {...} } ```
Then if you want to perform an action on a particular invoice, you can access it using the /invoices/:invoice_id/action endpoint. For example, let's say you want to pay the invoice with id=1, then all you have to do is make a POST request to /invoices/1/pay/
and if you want to pass variables to your action, you can do it through the body of the request. For example, if you want to pay your invoice with a card on the account with id=4, all you have to do would be to make a POST request to /invoices/1/pay/ with the following body:
``` { "card_id": 4 } ```
If you're giving trust to a user to query the API, they could also maliciously leak data or execute queries inside a normal web app just as easily if you build something appropriately secure.
It needs some real architecting skills to build secure and limited API. Unfortunately often ease is prefered over security for some so I have witnesed Elasticsearch or MongoDB APIs exposed to SPAs without any additional layer.