Here's a problem: how does a REST API prove it's serving the API you think it is? Serve some unique shared information on a particular URL?