Many-to-Many in REST?

Still trying to wrap my head around REST, and have a question for the lazyweb. Suppose my app contains users and groups, with a many-to-many relationship between them (i.e., a user can belong to any number of groups, and a group can contain any number of users. I can identify users as /app/user/fred, /app/user/jane, etc., and use GET/POST/PUT/DELETE to fetch, create, update, and delete. (Yeah, I know, GPPD != CRUD, but you get the idea.) I can similarly use /app/project/red and /app/project/green to identify projects, but what should I use to identify memberships? /app/project/green/user/fred? Nope: it mixes category identifiers (‘project’, ‘user’) and item identifiers (‘green’, ‘fred’), and more importantly, implies that users are sub-categories of projects—it would be just as logical to use /app/user/fred/project/green, which means that both are probably wrong.

In the relational database world, of course, many-to-many relationships are almost always represented by introducing new entities, such as a tuple <<17238917, ‘fred’, ‘green’>> (where 17238917 is a magic number created by the system for its own use, and not exposed to the outside world). Is that the right way to do many-to-many in REST? I.e., should /app/membership/17238917 return the pair <<‘fred’, ‘green’>>, while /app/project/green/members returns a list of magic membership tuple IDs, and /app/user/fred/groups returns ditto? What’s the right (or at least most common) way to do this?

In the wake of posts about Shopify's support for white nationalists and DataCamp's attempts to cover up sexual harassment
I have had to disable comments on this blog. Please email me if you'd like to get in touch.