"All requests should be made via the POST method, and all parameters should be passed in the POST request-body and not in the query-string."
So even typical GET are sent as POST (/api/1/bookmarks/list)
Is there any reason to do that?
That it's RPC over HTTP, POSTing everything is the normal (and, really, proper) way to do RPC over HTTP.
> If the response is not valid JSON, it should be interpreted as an HTTP 503 "Service Temporarily Unavailable" error, and the request should be retried later.
Why not just return 503?
xAuth provides a way for desktop and mobile
applications to exchange a username and password for
an OAuth access token. Once the access token is
retrieved, xAuth-enabled developers should dispose of
the login and password corresponding to the user.
Asking users to trust third parties with the access details to your application? Sure they "review" the API token requests but who knows what that means.
Reading the page there seems to be a lot of talk about "keeping it simple" as if using the HTTP protocol is hard and confusing for developers. This is a bad sign, if they don't understand or care to understand something simple what are their security practices like?