If you're being strict about REST, you're absolutely right. But I have spent a lot of my career building REST APIs for people and from that I've learned that what most people mean when they say "RESTful" is "easy to use, and easy to read". Arguably including the foreign keys as URLs makes it easier to use, but I'm arguing that it's not :-)