[atmosx]

HMAC for auth to avoid having the key exposed at every request.

For the rest: http://www.javabeat.net/rest-api-best-practices/

And documentation: https://github.com/Rebilly/ReDoc/blob/master/README.md

There many more comprehensive resources about sane API design (use HATEOAS, pagination, etc.) but you don't have to implement everything from v1

ps. SSL goes without saying even if it's a public API