Wouldn't you be better off exposing internal IDs? As it currently stands your keys and hence URIs are immutable, which could be a problem if somebody wanted to rename things after creating them.
edit: like the way you've emulated Facebook's Graph API wrt metadata - why not go all the way and drop XML support?