Conclusion

With a provider, a view controller, a controller and one line in rest.ini, an extension answers its own REST routes, with authentication, versions and JSON from the kernel. Before you ship it, check:

• Permissions: every action checks what the user may do; a REST call is not a way around the policies.
• API keys: a route that changes something needs a scope in [ApiKeySettings] RouteScopes[]; without one it is refused for every key.
• Caching: answers are cached per user by default ([CacheSettings] ApplicationCache=enabled, DefaultCacheTTL=600); switch it off for your controller when answers must always be fresh.
• Versions: changes that break clients go into a new version.
• CORS: a browser application on another host needs rest.ini [CorsSettings] Cors=enabled and its origin in AllowedOrigins[].

Related: Custom output renderers, REST API configuration settings.