Though the original post in very old the question is still relevant and the correct anwer probably has changed.
The old king - REST-APIs as defined by Fielding in 2000 - is dead for machine-to-machine communication.
The new king is "Open-API"-specified-API.
Its not the same. The most important difference is that REST by Fielding imagined a web that can be explored my means of HATEOAS. It was basically an adventure "full of unexpected options and suprises"
Open-API is in some sense the opposite. It is a strict contract that defines what operations can be called with what parameters and what results can be expected. There no element of suprise involved. Though this may sound boring, it is a very good characteristic for machine-to-machine communication.
The typical consumer of an "Open-API"-API generates client code out of the specification file. The generated code will automatically provide methods for the API-operations. Each method will expect parameters and a defined return type. Parameters will typically not be URLs. For that reason a URL in the location header will typically not be useful. Often it would need to be parsed "manually" in order to extract things such as business keys. That is annoying for the consumer.
Redirects are usually even worse. A method usually defines a definte return type. The consumer calls the operation and expects a definte return type. A redirect will typically redirect to some other operation defined by "Open-API". It may have a completely different return type. This is very annoying for the consumer. To my knowledge there is no means to actually reference the Open-API-operation to which is redirected by a Location header.
For those reasons i think the correct answer by now is:
For "Open-API"-APIs (formely known as REST) put URLs NEITHER into the Location header NOR into to Body.
Put data into the body that will serve as paramers to the subsequent API-calls.
And don't use redirects to other Open-API-operations.