Mike Partridge has the right answer above, but I just wanted to add.
Here's a good reference for the type of responses you should send to your restful requests.
Specifically, you should return 404 alongside PUT/DELETE requests to the collection (/folders) as well as for POST requests to the object (/folders/id).
Also, resources tend to be nested when it's relevant/appropriate to do so.
It seems like in your case, folders will always be a top level element, sets will always be in a folder, and cards will always be in sets, thus:
/folders/:id/sets/:id/cards/:id should be an allowed resource
I've seen this refered to as the digging-deeper-path-and-backspace convention where it's easy to move up the tree simply by backspacing to the last
The last link I provided has a lot of example URLs that you might use in a RESTful scheme. Another example excludes the collection names for child resources when only a specific child resource may exist at n-level:
I apologize if I caused more confusion. My point is there are a lot of options that are considered acceptable by different groups. Whatever convention you go with, just keep it consistent, and have good documentation for anyone who ends up using your API.