[bmn__]

This isn't REST, there are no hyperlinks and no hypermedia controls. It is designed pretty wrong. Just look at this brittle coupling!

    POST /api/player/actions
    Content-Type: application/json

    { "type": "shoot" }

How do I know what "type" of action is available to me? It isn't documented. Why should I need to know or try to look it up in the documentation in the first place, anyway? The server should just tell me what I can do, and then I act on it! Why should I need to know all these special URLs, except a single central entry point (a.k.a. bookmark)? The server should just tell me from each resource where I can go to! A more useful attempt:

    GET /
    Content-Type: text/html

    <p>The <a href="equipment#shotty">shotgun</a> is equipped.
    There is a <a href="items/157">green armor</a> ahead.</p>

    <p>You see a <a href="monsters/2018">baron of hell</a> attacking
    an <a href="monsters/1170">imp</a>.</p>

    <p>There is a <a href="doors/104">yellow-framed door</a>,
    attempt to <form action="doors/104" method="post">
    <input type="submit" value="open" /></form> it.</p>

    <form action="position" method="post">
        <input type="hidden" name="x" value="-225" />
        <input type="submit" value="move forward" /></form>,
    <form action="orientation" method="post">
        <input type="hidden" name="angle" value="90" />
        <input type="submit" value="turn left" /></form>
    …

(HTML used for ease of illustration on HN, alas JSON proper - being a dumb serialisation format - it deficient of hyperlinks or hypermedia controls, but there are extensions for it. This audience is less likely to be familiar with them.)

It really bothers me that programmers call things REST, and when you look at it it isn't REST at all because they don't know the first thing about it.

[MuffinFlavored]

In a traditional REST API, where do non-RESTful things (like other API calls, or "business logic") tend to go?

Is there /db/restEndpoints and /rpc/nonRESTfulEndpoints?

[Dashron]

Business logic should be hidden behind the API and the representation. Just like a website, actions are presented when the business logic allows it.

Other API calls depend on the purpose. If its part of the business logic, it's probably back end and hidden as described above.

If the other API call simply powers the UI, you might keep it in the client. One example is autocomple for facebook friends. The client can call facebook for a list, let the user select their friend, and then send that friends info to your API.

With that said, I'm not sure how either of those are "non-RESTful" so maybe I missed the point of the question?

[MuffinFlavored]

Can you share some of the extensions?

[Dashron]

I like hal+forms!