Let’s say I have several users and each one has a user_id and also friends
To access their friends, they should be logged in, so a session will be established with the server.
Should the REST API for their friends be user/:user_id/friends or just friends
0
The URL should be the same whether user is logged in or not.
The whole point of REST is to be as stateless as possible. Holding a stateful session so that you can say friends instead of user/:user_id/friends is not stateless, and the URL pointing to a particular resource should always be the same.