Hi Kevin,
The client app would request say:
https:/www.somecompany.com/ouath/rest/addinvoice?ouath_token={token}
and p_Filename in _SendFile would show:
/ouath/rest/addinvoice?ouath_token={token} (roughly)
From here you could parse (using stringTheory or manually) p_filename since the directories are just a hierarchy that represents context, and sometimes key values.
Marks job will be much easier if he is using oAuth2 which is lovely compared to oAuth1. SkyDrive and Google use oAuth2. Dropbox has started to allow oAuth2 but alas Xero still hasn't and doesn't really appear to care.
If you were writing your own rest web server, then oAuth2 is definitely the way to go as SSL does all the annoying work for you.
Also, I think (and Bruce could correct me if i'm wrong) NetTalk ignores preceding folders names, so you'd want addinvoice to not also be used as a pagename, otherwise it will not get to _SendFile.
Regards
Bill