I think it's unusual to have a multi-pk table modeled as a SQL Resource directly, rather than as a secondary player (role = join). At some point /res/{resName}/{resId}/{resId} was working and the code appears to allow up to three pk values.

If we model sakila.film_actor as

<rs:sqlResource xmlns:rs="http://restsql.org/schema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

select actor_id "actorId", film_id
from film_actor

This is from restsql-test/src/resources/xml/sqlresources/SingleTable_MultiPk.xml.

We can see two primary keys when viewing the metadata (/restsql/conf/metadata/SingleTable_MultiPk), however the SQL generated uses the first key for both values, even when only a single one is requested. From the trace log:

0:0:0:0:0:0:0:1 2017-03-15 09:11:25,857 GET /restsql/res/SingleTable_MultiPk/2 200 7ms
sql:
select actor_id "actorId", film_id
from film_actor WHERE film_actor.actor_id = 2 AND film_actor.film_id = 2 ORDER BY film_actor.actor_id, film_actor.film_id
response: