Better yet, those URLs communicate what you may do. Instead of building the logic to determine if, say, a Payment can be cancelled, based on its attributes, yo

Better yet, those URLs communicate what you may do. Instead of building the logic to determine if, say, a Payment can be cancelled, based on its attributes, you simply check 'is the cancel link there'. I find this a critical feature. Because between the backend, and various mobile clients, react, some admin, and several versions thereof, clients will implement such businesslogic wrong. Much better to make the backend responsible for communicating abilities. Because that backend has to do this anyway already.