So, I generally do it the nested way: organizations/:organizationId/blogs/:blogId The other post on this thread are accurate, in that normally keeping it simpl

So, I generally do it the nested way: organizations/:organizationId/blogs/:blogId The other post on this thread are accurate, in that normally keeping it simpler is better, but in this case I disagree. With the nested approach you have the ability to do multiple levels of validation and mitigate a lot of key guessing attacks. Imagine a different scenario: facility/:facility_id/provider/:provider_id/patient/:patient_id Vs patient/:patient_id In the first case there are three tokens I'd need to possess or guess in order to access a patient record. In the second, there's just one. The implementation will still only grab the patient id for the query, but it'll validate that the two other keys are correct as well. It also makes role scoping easier. I.e. my role grants admin access to all patients in a facility. Middleware to validate the access is a lot easier to implement if you have all those keys in the query string. Declarative permissions on the routes are a lot easier.