$scope.genres = [];

Genre.find().$promise.then(function(res) { //this request works : goes to GET /Genres endpoint
  $scope.genres = res;
  $scope.genres.forEach(function(genre) {

    genre.checked=false;
    genre.subgenres = [];
    Genre.subGenres({id: genre.id}).$promise.then(function(r){ //it is this one that doesn't work, GET /Genres/:id/SubGenre endpoint

      genre.subgenres = r;
      genre.subgenres.forEach(function(s){
        s.checked=false;
      });
    });
  });
});

// INTERNAL. Use SubGenre.genres() instead.
    "prototype$__get__genres": {
      isArray: true,
      url: urlBase + "/SubGenres/:id/genres",
      method: "GET"
    },

"acls": [
  {
    "accessType": "*",
    "principalType": "ROLE",
    "principalId": "$everyone",
    "permission": "DENY"
  },
  {
    "accessType": "EXECUTE",
    "principalType": "ROLE",
    "principalId": "$authenticated",
    "permission": "ALLOW",
    "property": "subGenres" // this is to authorize Genre.subGenre(), doesn't works => 401 error.
  },
  {
    "accessType": "EXECUTE",
    "principalType": "ROLE",
    "principalId": "$authenticated",
    "permission": "ALLOW",
    "property": "find" // this is to authorize Genre.find(), it works
  }