The idea is to limit exposed routes to the standard CRUD routes: create (/new), read (/show), update (/edit), delete (/destroy).
Create: POST /resources (or PUT /resources/42)
Read: GET /resources/42
Update: PUT /resources/42 (or PATCH /resources/42)
Delete: DELETE /resources/42
List/Search: GET /resources