I would probably argue that this is inconsistent with the rest of the API. We aren't using nested routes for show/update/destroy. Here are some examples:

https://github.com/Katello/katello/blob/master/app/controllers/katello/api/v2/activation_keys_controller.rb#L73-L90
https://github.com/Katello/katello/blob/master/app/controllers/katello/api/v2/products_controller.rb#L71-L96
https://github.com/Katello/katello/blob/master/app/controllers/katello/api/v2/products_controller.rb#L71-L96
https://github.com/Katello/katello/blob/master/app/controllers/katello/api/v2/systems_controller.rb#L163-L213

Many of these routes could be scoped to things like organizations, providers, etc. but they aren't. There aren't any nested routes at all. The rule of thumb we've been using is that if the ID is unique for the app, it doesn't need to be nested.