[SalesForce] Salesforce Tooling API for ValidationRule

You do need to use the Tooling API to update Apex classes. Updating an Apex class is a more complex operation than creating a class, since you may have a set of updates that need to be applied as a single set of changes, and it's an asynchronous operation.

The Tooling API docs have some sample code for REST and for SOAP. I built a very basic code editor as an example in Java that pulls it together - here is the code to update an Apex Class. I've added some comments to show the flow:

try {
    // The container for the entire request
    JSONObject metadataContainerRequest = new JSONObject();
    metadataContainerRequest.put("Name", "SaveClass" + id);
    JSONObject metadataContainerResponse = ToolingApi.post("sobjects/MetadataContainer", metadataContainerRequest);
    System.out.println("MetadataContainer id: " + metadataContainerResponse.get("id"));

    // Wrapper for changes to a single Apex class - you could add several of these
    // to a single metadata container
    JSONObject apexClassMemberRequest = new JSONObject();
    apexClassMemberRequest.put("MetadataContainerId", metadataContainerResponse.get("id"));
    apexClassMemberRequest.put("ContentEntityId", id);
    apexClassMemberRequest.put("Body", body);
    JSONObject apexClassMemberResponse = ToolingApi.post("sobjects/ApexClassMember", apexClassMemberRequest);
    System.out.println("ApexClassMember id: " + apexClassMemberResponse.get("id"));

    // Apply the changes
    JSONObject containerAsyncRequest = new JSONObject();
    containerAsyncRequest.put("MetadataContainerId", metadataContainerResponse.get("id"));
    containerAsyncRequest.put("isCheckOnly", false);
    JSONObject containerAsyncResponse = ToolingApi.post("sobjects/ContainerAsyncRequest", containerAsyncRequest);
    System.out.println("ContainerAsyncRequest id: " + containerAsyncResponse.get("id"));

    // See if the update is complete, keep checking until it is
    JSONObject result = ToolingApi.get("sobjects/ContainerAsyncRequest/"
        + containerAsyncResponse.get("id"));
    String state = (String) result.get("State");
    System.out.println("State: " + state);
    int wait = 1;
    while (state.equals("Queued")) {
        try {
            System.out.println("Sleeping for " + wait + " second(s)");
            Thread.sleep(wait * 1000);
        } catch (InterruptedException ex) {
            Thread.currentThread().interrupt();
        }

        wait *= 2;

        result = ToolingApi.get("sobjects/ContainerAsyncRequest/" + containerAsyncResponse.get("id"));
        state = (String) result.get("State");
        System.out.println("State: " + state);
    }

    // Housekeeping - delete the container
    ToolingApi.delete("sobjects/MetadataContainer/" + metadataContainerResponse.get("id"));

    if (state.equals("Completed")) {
        // Success!
        return "redirect:../classes";
    } else {
        // Failure - show errors to user
        map.put("body", body);
        map.put("errorMsg", result.get("ErrorMsg"));
        String compilerErrors = (String) result.get("CompilerErrors");
        if (compilerErrors != null) {
            JSONArray parsedErrors = (JSONArray) JSONValue.parse(compilerErrors);
            map.put("compilerErrors", parsedErrors);
        }
        return "classDetail";
    }
} catch (RuntimeException e) {
    map.put("errorMsg", e.getMessage()); // TODO: better looking error
    return "classDetail";
}

Even though this question is one year old I had the same issue today and found a solution to that problem.

With standard Rest API, your request only needs a slight modification:

{  
    "FinServ__Account__r":{  
        "External_Id__c":"account-external-id-1"
    },
    "FinServ__Message__c":"Alert-Subject-Finserv-CREATE-1",
    "FinServ__MessageDescription__c":"Alert-Description-Finserv-CREATE-1",
    "FinServ__Active__c":false,
    "Owner": {
        "attributes": {
            "type": "User"  
        },
        "External_Id__c":"user-external-id-1"
    }
}

Note the additional hint to what will actually be transferred within Owner structure via the attributes sub type.

I did not find official documentation on this, however, it just works. :)