What belongs to the Controller-layer, what to the Service-layer?

Service Class

public class UserService {
     public User findUser(String id){
          log.info("Invoked method: get with ID: " + id);
          log.warn("Searching for user with ID " + id);
          User user = userRepository.findOne(id);
          if (user == null){
            log.error("Unexpected error, User with ID " + id + " not found");
            throw new NotFoundException("User with ID " + id + " not found");
          }
         log.info("User found. Sending request back. ID of user is " + id);
         return user;
     }
}

API class

    @RequestMapping(value = "users/{id}", method = RequestMethod.GET)
    public Resource<UserResource> get(@PathVariable Long id) throws    NotFoundException {
          return new Resource<UserResource>(userService.findUser(id));
    }

Add common exception handler NotFoundException to redirect to proper error page.

Ask yourself: what needs to change if I want to render results for a different view/transport/protocol? That belongs in the controller.

Code in the Controller layer should only be related to mapping business input/output between the Service layer to the view/transport/protocol (as appropriate). This might (or might not) include mapping business data into JSON (it's not unreasonable for your business/service layer to work directly with JSON or similar), XML, HTML, or whatever your content type might be (for HTTP).

While your Controller may feel lightweight, keep in mind that Spring's backing of the controller does much of the work - think of such a "simple" controller as a anchor-point that your framework recognizes and hangs all the heavier, boiler-plate, code off of, to your benefit.