The definition of the base URI is up to the provider of the service. The only requirements are the use of HTTPS and the presence of the service's version information, so that further changes are possible without breaking existing clients.
=== Client authentication and authorization ===
The service needs to authenticate each client via HTTP basic authentication by a user name and a corresponding password.
Furthermore the service must retrieve the authenticated users role and object ownership and respect their respective value when returning collections and elements and acting on HTTP methods.
=== Data interchange format ===