<p>When designing a REST API or service are there any established best practices for dealing with security (Authentication, Authorization, Identity Management) ?</p>

<p>When building a SOAP API you have WS-Security as a guide and much literature exists on the topic. I have found less information about securing REST endpoints.</p>

<p>While I understand REST intentionally does not have specifications analogous to WS-* I am hoping best practices or recommended patterns have emerged.</p>

<p>Any discussion or links to relevant documents would be very much appreciated.
If it matters, we would be using WCF with POX/JSON serialized messages for our REST API's/Services built using v3.5 of the .NET Framework.</p>

There are no standards for REST other than HTTP. There are established REST services out there. I suggest you take a peek at them and get a feel for how they work.
For example, we borrowed a lot of ideas from Amazon's S3 REST service when developing our own. But we opted not to use the more advanced security model based on request signatures. The simpler approach is HTTP Basic auth over SSL. You have to decide what works best in your situation.
Also, I highly recommend the book
RESTful Web Services
from O'reilly. It explains the core concepts and does provide some best practices. You can generally take the model they provide and map it to your own application.