java - JAX-RS (Jersey) Admin Only API Calls -

this may turn out more of style question, i'm little stumped on how best design restful api.

let's want provide following api calls:

• get /player
  • returns current player
• get /player/{id}
  • returns specified player
• post /admin/player/{id}
  • registers specified player
• put /admin/player/{id}
  • updates specified player

as surmised, last 2 require administrative rights, , first 2 merely require user logged system.

so question involves how best lay api out resources. first instinct create single playerresource doesn't have class-level @path annotation, rather defines each method @path("player/...") or @path("admin/player/...") accordingly. work? smells bit me, there better way style-wise? alternative can think of create separate resource class contain admin-only calls, smells me since i'd have 2 resources dealing same model class.

i'm looking little guidance on how best design thing. first restful web app, forgive horrible ignorance. thanks!

i not go having seperate resource admin calls. if user making call doesnt have rights post or put specific resource, return 401-unauthorized status code. that's, in opinion, proper , intended way of doing it.

edit after comment:

as mentioned, have security constraints defined via web.xml, guess have user roles.

this allow following :)

@put @rolesallowed("admin") public void register(user user){......) 

you have put https://jersey.java.net/nonav/apidocs/1.5/jersey/com/sun/jersey/api/container/filter/rolesallowedresourcefilterfactory.html in place :)

edit2

my resources this. (exceptions allowed :) )

@path("/players") public class playerresource{   @get   public list<player> list(){}    @get   @path("{id}")   public player get(@pathparam("id")long id){}    @delete   @rolesallowed("admin")   @path("{id}")   public player delete(@pathparam("id")long id){}    //put , post ommited  } 

regards