Cybersecurity glossary
What is Representational State Transfer (REST)?
Learn what REST is, how resource-oriented HTTP APIs use methods and representations, how REST compares to RPC and GraphQL, and which security practices matter for RESTful services.
Definition
Representational State Transfer (REST) is an architectural style for networked applications that models the system as resources identified by URIs, manipulated through uniform interface operations—commonly HTTP methods—and exchanged as representations such as JSON.
Why REST matters
Public and private APIs need a shared vocabulary. Without one, every team invents bespoke RPC endpoints, inconsistent errors, and unpredictable caching behavior.
Representational State Transfer (REST)—introduced by Roy Fielding—offers constraints that favor scalability and simplicity on the web: resource identifiers, a uniform interface, stateless interactions, and cacheable representations. Most “REST APIs” today apply a pragmatic subset of those ideas over HTTP and JSON.
Core REST ideas
Resources and URIs
Nouns like `/orders/123` identify things; avoid encoding every action only as a custom verb path when a method fits.
Uniform interface
HTTP methods and status codes give clients a predictable way to read, replace, and delete.
Representations
Clients exchange JSON or other formats that represent resource state—not necessarily the internal DB row.
Stateless requests
Each call authenticates and identifies what it needs; servers scale by not holding hidden per-client conversation state.
How a typical REST request works
Client targets a resource URI
The path and maybe query parameters identify the resource collection or item.
An HTTP method expresses intent
GET reads, PUT replaces, PATCH partially updates, DELETE removes, POST creates or triggers processing.
Server authenticates and authorizes
Tokens or sessions establish identity; object-level checks protect the specific resource.
A representation is returned
JSON bodies and status codes communicate the new or current state.
Caches may store eligible GETs
Cache-Control and related headers enable CDNs and browsers to reuse safe responses.
Clients evolve via versioning or compatibility rules
URI versions, headers, or careful field addition keep consumers working.
REST vs neighboring styles
| Topic | REST (typical HTTP) | Other common styles |
|---|---|---|
| Shape | Many resource URLs | GraphQL: one schema endpoint; RPC: procedure URLs |
| Contract | OpenAPI often documents resources | Protobuf/gRPC IDLs; GraphQL schemas; WSDL for SOAP |
| Caching | Natural for GET representations | Harder for arbitrary query/RPC shapes |
| Streaming | Not the primary model | gRPC streams; GraphQL subscriptions; WebSockets |
REST security essentials
Object-level authorization
Never assume knowing `/users/5` implies permission—check every ID (BOLA/IDOR).
TLS everywhere
REST over cleartext HTTP exposes tokens and personal data on the path.
Input validation
Reject unexpected fields, oversize bodies, and broken content types early.
Consistent error semantics
Use honest status codes without leaking stack traces or sensitive existence oracles.
Rate and abuse controls
Protect list endpoints, login, and expensive searches from scraping and stuffing.
Least privilege tokens
Scope OAuth/API keys to the resources and methods a client truly needs.
Practical checklist
- Model primary nouns as resources with clear ownership and identifiers.
- Map operations to HTTP methods that match safety and idempotency expectations.
- Document the API with OpenAPI or equivalent and keep it in CI.
- Enforce authz on every resource ID, including nested routes.
- Apply Cache-Control correctly; default authenticated responses to private/no-store.
- Version or compatibility-test breaking changes before release.
- Add rate limits and pagination on collection endpoints.
- Test negative authorization cases as thoroughly as happy-path CRUD.
The practical takeaway
REST is an architectural style that builds networked apps around resources, uniform HTTP operations, and exchangeable representations. Pragmatic REST APIs dominate the web because they align with HTTP caching, status codes, and tooling.
Use REST constraints to keep APIs predictable—then secure them like any sensitive interface: encrypt, authenticate, authorize per object, validate input, and quota expensive reads and writes.
Related security terms
HTTP Method
Uniform interface verbs REST APIs commonly map to resource operations.
GraphQL
An alternative API style focused on client-specified query shapes.
Simple Object Access Protocol (SOAP)
A protocol-centric alternative historically used for enterprise APIs.
Idempotency
A property REST designs lean on for safe retries of resource operations.
API Abuse
Misuse patterns that REST endpoints must rate-limit and authorize against.
Frequently asked questions
What is REST in simple terms?
It is a way to design web APIs around things (resources) you can read or change with standard HTTP actions—like GET to read and DELETE to remove—usually exchanging JSON.
Is every JSON HTTP API RESTful?
No. Many APIs use HTTP and JSON without following resource modeling, hypermedia, or uniform interface constraints. “REST-ish” is common.
Does REST require JSON?
No. REST is about resources and representations. JSON is popular, but XML, images, and other formats can be representations too.
How is REST different from SOAP?
REST is an architectural style typically over plain HTTP resources. SOAP is a protocol with XML envelopes and a fuller enterprise stack (WS-* standards).
How is REST different from GraphQL?
REST usually exposes many resource URLs with server-defined representations. GraphQL typically exposes one endpoint where clients select fields from a schema.
What does stateless mean in REST?
Each request should carry the information the server needs to understand it (credentials, resource IDs). Servers should not rely on hidden conversational memory for correctness.
Are REST APIs automatically secure?
No. REST gives useful conventions, but authentication, authorization, validation, and TLS are still your responsibility.
References
Explore authoritative guidance and frameworks related to representational state transfer (rest).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.