REST is for client-server applications. There is a backend and a frontend, where the first just defines the REST service, and the second does the mapping.
Here's an example: I have a website and a mobile application, but there is a server with a database. So, the site and the application are the data representation and each does it in its own way, but both are based on the data provided by the service, which is directly connected to the database.
If the application is built on models (entities), which is good, then the code will be something like this
$users = UserRepository::find()->where('role'=>'online_access');
But it may look differently, depending on what the architecture is, etc. In general, the essence is that the backend works with the database and data, then leads them to some sort.
UPD. Here's an example of a working method from a REST service.
/** * All * Lists all Users (available for roles with code LIST_ACCESS) * * @throws EmptyResponseException If no user was found * @throws ForbiddenHttpException If role code LIST_ACCESS not available * * @return array of users */ public function actionAll() { /** @var User $user to find */ $user = User::findOne( [ 'token' => $this->getToken() ] ); /** If no data was fetched */ if (is_null($user)) { throw new EmptyResponseException; } /** @var Role $role of fetched user so we can decide, is that page available or not */ $role = $user->getRole(); /** Check section access to view other profiles */ if (!$role->hasSectionAccess(self::LIST_ACCESS)) { throw new ForbiddenHttpException("Access denied for this user"); } /** Fetch all users */ return $this->response(User::find()->all()); }