I usually implement this as Http delete with a json array of ids in the body.

Probably in violation of some standard, but seems sensible enough.