RestfulServer is the publisher (Restful Service and RestfulServer are 2 different things). And yes AFAIK it supports JSON or XML output.

See
http://doc.silverstripe.org/restfulserver
http://api.silverstripe.com/2.4/sapphire/api/RestfulServer.html

Based on the example listed in the RestFul server
class Article extends DataObject {
   static $db = array('ID'=>'int',Title'=>'Text','Published'=>'Boolean');
...
}
it is possible then to retrieve the JSON format of the Article using a URL accessing the .../v1/article/12
(assuming the there is an Article with ID= 12)

I would like to make sure that only the embeded java applets or Flash object can call the Silverstripe Restful server but
not a user that directly key in the correct URL.

Is there some way to do that? Before the RestServer return the result in Json format, it checked if there is existing user log in.

Thank you.