RESTful object access management