{"action":"created","issue":{"url":"https://api.github.com/repos/lightvector/arimaa-server/issues/32","labels_url":"https://api.github.com/repos/lightvector/arimaa-server/issues/32/labels{/name}","comments_url":"https://api.github.com/repos/lightvector/arimaa-server/issues/32/comments","events_url":"https://api.github.com/repos/lightvector/arimaa-server/issues/32/events","html_url":"https://github.com/lightvector/arimaa-server/pull/32","id":88052540,"number":32,"title":"Add partial API draft","user":{"login":"lightvector","id":11942395,"avatar_url":"https://avatars.githubusercontent.com/u/11942395?v=3","gravatar_id":"","url":"https://api.github.com/users/lightvector","html_url":"https://github.com/lightvector","followers_url":"https://api.github.com/users/lightvector/followers","following_url":"https://api.github.com/users/lightvector/following{/other_user}","gists_url":"https://api.github.com/users/lightvector/gists{/gist_id}","starred_url":"https://api.github.com/users/lightvector/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lightvector/subscriptions","organizations_url":"https://api.github.com/users/lightvector/orgs","repos_url":"https://api.github.com/users/lightvector/repos","events_url":"https://api.github.com/users/lightvector/events{/privacy}","received_events_url":"https://api.github.com/users/lightvector/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-06-13T19:28:29Z","updated_at":"2015-06-19T03:57:56Z","closed_at":"2015-06-17T03:42:15Z","pull_request":{"url":"https://api.github.com/repos/lightvector/arimaa-server/pulls/32","html_url":"https://github.com/lightvector/arimaa-server/pull/32","diff_url":"https://github.com/lightvector/arimaa-server/pull/32.diff","patch_url":"https://github.com/lightvector/arimaa-server/pull/32.patch"},"body":"Not complete, but opening this up anyways so that we can begin to get some comments. If something is silly or poorly designed below, don't hesitate to say so. Happy to talk further.\r\n\r\nAs it stands, I believe this API is not completely conforming to the REST philosophy regarding resource path names, and also due to the choice of how to do authentication. But I hope the choices are reasonable nonetheless.\r\n"},"comment":{"url":"https://api.github.com/repos/lightvector/arimaa-server/issues/comments/113359204","html_url":"https://github.com/lightvector/arimaa-server/pull/32#issuecomment-113359204","issue_url":"https://api.github.com/repos/lightvector/arimaa-server/issues/32","id":113359204,"user":{"login":"mattj256","id":5423966,"avatar_url":"https://avatars.githubusercontent.com/u/5423966?v=3","gravatar_id":"","url":"https://api.github.com/users/mattj256","html_url":"https://github.com/mattj256","followers_url":"https://api.github.com/users/mattj256/followers","following_url":"https://api.github.com/users/mattj256/following{/other_user}","gists_url":"https://api.github.com/users/mattj256/gists{/gist_id}","starred_url":"https://api.github.com/users/mattj256/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattj256/subscriptions","organizations_url":"https://api.github.com/users/mattj256/orgs","repos_url":"https://api.github.com/users/mattj256/repos","events_url":"https://api.github.com/users/mattj256/events{/privacy}","received_events_url":"https://api.github.com/users/mattj256/received_events","type":"User","site_admin":false},"created_at":"2015-06-19T03:57:56Z","updated_at":"2015-06-19T03:57:56Z","body":"> The REST philosophy of design, as I understand it, tries to aim for minimizing the amount of state in the protocol, so that the server has to remember nothing about its connection with the client, it just has to service requests and it doesn't matter who or where they come from. This is somewhat at odds with the idea of authenticating the client and having a secure connection. \r\n\r\n@lightvector \r\nYes it makes sense that the client should be authenticated.  Do we need transport-level security?  I thought it was fine to login and get a token.\r\n\r\nSome options:\r\n\r\n- OAuth\r\n- https rather than http\r\n- YouTube: send a token with every request: https://developers.google.com/youtube/registering_an_application\r\n- http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/\r\n\r\n\r\n\r\n>> Is there any value to making our API similar to the old API on arimaa.org? (I don't even know what the old API looks like.)\r\n\r\n> Yes, but after some thought over the last few weeks, I think not enough value. :) \r\n\r\nOk.  If the arimaa.com API is secret-ish then hardly anyone would have written anything to connect to it, so there's very little to be lost in making our API different.  I just think it should be a deliberate decision to imitate or not imitate arimaa.com."}}