Matt,
 
Let me start off by clarifying a point or two. The REST protocol itself does not specify how a username and password are to be provided. The DMS API does not pass login credentials in the RESTful part of the API call. What is happening is that RESTful calls are being made over HTTP, and we authenticate username and password using the HTTP Basic Authentication method. You can pry into the technical details of this in the document attached (rfc2617 pg.7), but to explain it at a high level, the username and password are passed into the header of whichever method (GET, POST, PUT, or DELETE) that you are making.
 
Please note that HTTP Basic Authentication is not inherently secure. It is passed through as clear text that can be viewed by anyone. If you want to make sure it is secure you will need to pass your login credentials over SSL. If you don't do this, you will automatially be redirected to a secure site once the call is made, but by this point your password may have already been read.
 
Let me know if you need anything else
-Hashir

Attachments: