How are you modeling authentication operation? about http-api-design HOT 1 OPEN

It depends a lot on how your authentication works. ie, in many cases it makes sense to just pass auth in the Authorization header (using basic or token auth perhaps). SAML is a special case though, and one (I must warn you) I am not very familiar with. I read the wikipedia page a bit to give myself a rough idea, and given that I would say something like POST /security-contexts would probably make a lot of sense. I'd just note two small differences from what you suggested: 1) plural spelling of context and 2) dasherize the space between the two words. Both of those are just to follow existing conventions. Although singular spelling might make since if this is a singleton (as I suspect it might be), ie if each user would only ever have a single valid context. That said, I think just always using plurals can be nice for the sake of consistency also. Hope that helps, but happy to discuss further as needed. Thanks!

from http-api-design.