Create secure REST API framework

I need a secure REST API framework created for a CRM web application - the API should be totally secure and linked to a company account in a MySQL database. From that connection it should then only ever allow interaction with that company's details throughout. At all times all communication should be done via https and should not work if only http is used.

The API needs to ensure every request is valid based on lookup in MySQL and it should support GET, POST, PUT and DELETE. For each HTTP method, there should be the ability to perform acrtion against all records or just one - e.g. /api/users/get should show all users but /api/users/get/4 should only show user 4.

For testing I will require you to demonstrate the API performing each HTTP method working with three tables (one example containing one table and one example containing two tables). It should send both XML and JSON.

It should be flexible so I can easily add new permitted tables as well as define which fields can be used in the API for each table and what actions can be performed for each HTTP method.

For example,

allow get, put, post and delete access to only name, address and town in users
allow get to only date and action in auditing
allow get, put, post and delete access to all fields in customers

Full and complete documentation including examples is required. Also please note this should not require any frameworks as the application is built on plain and simple PHP.