That's how we started. Eventually, we wound up ditching Django-REST-
API entirely.
If you're not using their collections, then all that's left is
authentication.
Consider designing a class which authenticates the HTTP_AUTHORIZATION
header, checks the user's permissions and then dispatches GET, POST,
PUT and DELETE to separate methods of the class.
A subclass can then do the real work of the URI, either fetching from
a query set, using a Form to validate and persist objects.