This surely has nothing to do with the security problem, even if it's not exactly REST. It's not even that unusual for browser focused APIs: For example, many o

This surely has nothing to do with the security problem, even if it's not exactly REST. It's not even that unusual for browser focused APIs: For example, many older browsers don't support sending the DELETE method, so Ruby on Rails applications often send Ajax DELETE requests as a POST, with the "_method" parameter set to "delete" (rather than a different URL as in the case of Instagram). That's probably not the reason in Instagram's case, but if you look at a lot of public REST APIs you are going to find many things that aren't exactly "REST".