I'll try to answer these one by one to the best of my abilities. I can't post more than two links without more rep, so just remove the 's' before my links to use them.
For http Requests via javascript it is important that you understand CORS
CORS tutorial
AJAX,
also it would be useful to check out
XmlHttpRequest
Reading the specification on rest is probably one of the best ways to get to know the fine details of what REST is and is capable of. Finding tutorials for using REST in programming largely depends on the language.
1: What kind of javascript object to create (e.g. a XMLHttpRequest?)
This depends on your browser and the version it is.
There are:
XMLHttpRequests found in IE7+, Firefox, chrome, safari ( Latest versions of these browsers supports CORS check here to see which ones.
XDomainRequests: found in IE 8 and IE 9 (supports CORS)
activeXObject: found in IE 6,7,8,9,10 (does not support CORS)
You can learn more about IE specific objects using microsoft's msdn api reference. Usually a quick google will have good results for these objects.
2: How to construct a url request (build a query)
Assuming this is for javascript building the request depends on the server you are sending it to. I have already linked you to several links that help you build the http request and send it. If you want to see an actual implementation that is in practice now, you can check out :
the request function in apigee's usergrid.js
at line 67( at the time I posted this),
If you want to see how to build the query string( the '?' after the URI) check the encodeParams function in that link. Note there are many ways to do this. This is just one. You could easily just append the "param=value" on by on on to the "uri" + '?'
Something to note is that the Apigee example is not Cross Browser Compatibly. It just assumes XMLHttpRequest Version 2 which not all versions of browsers support.
3: How the parts of request relate to the application (backend) I'm targeting.
If you are targeting kinvey that RESTful api link you provided is really the best way to explain it. It details what your url and http request headers should look like for the actions you are trying to take. The guides Kinvey has for rest have more specific examples for an http request.
The components that go in to the URL largely depend on the backend. If you have a more specific question I can try to answer that.
4: How / where / if my credentials fit in
This again depends on the backend/server. For Kinvey they use Basic Auth and OAuth.
You should check out their guides on security for more info about that.
If you studied/researched the initial links I posted and learned about http requests then your credentials would go under the Authorization header of the httpRequest. For kinvey it usually goes like this:
Authorization: "Basic " + Base64encoding[appId:appSecret] or "Kinvey " + [authToken]
5: How to handle the response.
Again depends on the backend/server.
The aforementioned links on AJAX and CORS tutorial show you how to handle the response.
There are many different responses you can get, xml, json, simple text etc. The type you want is usually specified in the request header's accept field by You or by the server's response header's content-type which tells you what type it sent back or can send back, but that requires calling to the server once to see what it sends by default. Many mBaaS usually specify the responses in their documentation
For kinvey, they usually send back JSON so you can just use JSON.parse() the response and access the data you need from the JSON object.
Hopefully that answered some or all of your questions and if anyone thinks I did something wrong or said something horribly inaccurate let me know. This is my first time posting on stack overflow, but I have used kinvey as well as many other mBaaSes for my work. So I got to know them a little.
Finally, if you learned what you wanted to, just use Kinvey's javascript api which will handle all the interactions with RESt for you. No need to reinvent the wheel unless you need to do something more specific that JS frameworks don't provide.