I have perused the questions asked about this, but I still don\'t have a definitive answer.
I have an application and would like to build a RESTful API to expose a s
IMHO you are modelling it well.
Regarding 1
I'd rather go with resource/id
rather than query param. But one thing you must have in mind when modelling is the cache mechanism by proxy and so on. So do not forget the headers.
I go for query params for filtering and those sorts.
About the login, the credentials should be in the headers, and no specific resource is needed. Just apply per resource security.