Update to Drupal 8.2.0. For more information, see https://www.drupal.org/project/drupal/releases/8.2.0

core/modules/rest/config/install/rest.settings.yml

@@ -1,50 +1,11 @@
-# Enable all methods on nodes.
-# You must install Hal and Basic_auth modules for this to work. Also, if you are
-# going to use Basic_auth in a production environment then you should consider
-# setting up SSL.
-# There are alternatives to Basic_auth in contrib such as OAuth module.
-resources:
-  entity:node:
-    GET:
-      supported_formats:
-        - hal_json
-      supported_auth:
-        - basic_auth
-    POST:
-      supported_formats:
-        - hal_json
-      supported_auth:
-        - basic_auth
-    PATCH:
-      supported_formats:
-        - hal_json
-      supported_auth:
-        - basic_auth
-    DELETE:
-      supported_formats:
-        - hal_json
-      supported_auth:
-        - basic_auth
-
-# Multiple formats and multiple authentication providers can be defined for a
-# resource:
-#
-# resources:
-#   entity:node:
-#     GET:
-#       supported_formats:
-#         - json
-#         - hal_json
-#         - xml
-#       supported_auth:
-#         - cookie
-#         - basic_auth
-#
-# hal_json is the only format supported for POST and PATCH methods.
-#
-# The full documentation is located at
-# https://www.drupal.org/documentation/modules/rest.
-
 # Set the domain for REST type and relation links.
 # If left blank, the site's domain will be used.
 link_domain: ~
+
+# Before Drupal 8.2, EntityResource used permissions as well as the entity
+# access system for access checking. This was confusing, and it only did this
+# for historical reasons. New Drupal installations opt out from this by default
+# (hence this is set to false), existing installations opt in to it.
+# @see rest_update_8203()
+# @see https://www.drupal.org/node/2664780
+bc_entity_resource_permissions: false

core/modules/rest/config/optional/rest.resource.entity.node.yml

@@ -0,0 +1,20 @@
+langcode: en
+status: true
+dependencies:
+  module:
+    - basic_auth
+    - hal
+    - node
+id: entity.node
+plugin_id: 'entity:node'
+granularity: resource
+configuration:
+  methods:
+    - GET
+    - POST
+    - PATCH
+    - DELETE
+  formats:
+    - hal_json
+  authentication:
+    - basic_auth

core/modules/rest/config/schema/rest.schema.yml

@@ -1,20 +1,17 @@
 # Schema for the configuration files of the REST module.
-
 rest.settings:
   type: config_object
   label: 'REST settings'
   mapping:
-    resources:
-      type: sequence
-      label: 'Resources'
-      sequence:
-        type: rest_resource
-        label: 'Resource'
     link_domain:
       type: string
       label: 'Domain of the relation'
+    bc_entity_resource_permissions:
+      type: boolean
+      label: 'Whether the pre Drupal 8.2.x behavior of having permissions for EntityResource is enabled or not.'
 
-rest_resource:
+# Method-level granularity of REST resource configuration.
+rest_resource.method:
   type: mapping
   mapping:
     GET:
@@ -30,6 +27,29 @@ rest_resource:
       type: rest_request
       label: 'DELETE method settings'
 
+# Resource-level granularity of REST resource configuration.
+rest_resource.resource:
+  type: mapping
+  mapping:
+    methods:
+      type: sequence
+      label: 'Supported methods'
+      sequence:
+        type: string
+        label: 'HTTP method'
+    formats:
+      type: sequence
+      label: 'Supported formats'
+      sequence:
+        type: string
+        label: 'Format'
+    authentication:
+      type: sequence
+      label: 'Supported authentication providers'
+      sequence:
+        type: string
+        label: 'Authentication provider'
+
 rest_request:
   type: mapping
   mapping:
@@ -45,3 +65,20 @@ rest_request:
       sequence:
         type: string
         label: 'Authentication'
+
+rest.resource.*:
+  type: config_entity
+  label: 'REST resource config'
+  mapping:
+    id:
+      type: string
+      label: 'REST resource config ID'
+    plugin_id:
+      type: string
+      label: 'REST resource plugin id'
+    granularity:
+      type: string
+      label: 'REST resource configuration granularity'
+    configuration:
+      type: rest_resource.[%parent.granularity]
+      label: 'REST resource configuration'

core/modules/rest/config/schema/rest.views.schema.yml

@@ -3,6 +3,13 @@
 views.display.rest_export:
   type: views_display_path
   label: 'REST display options'
+  mapping:
+    auth:
+      type: sequence
+      label: 'Authentication'
+      sequence:
+        type: string
+        label: 'Authentication Provider'
 
 views.row.data_field:
   type: views_row