Cybersecurity glossary
What is a REST API?
Learn what a REST API is in practice, how resource-oriented HTTP endpoints work, how REST APIs are secured, and how they differ from GraphQL and RPC-style interfaces.
Definition
A REST API is an application programming interface that exposes resources over HTTP using resource URIs, standard methods such as GET POST PUT PATCH and DELETE, and representations like JSON—following REST architectural constraints to varying degrees in real-world implementations.
Why REST APIs matter
Most product backends speak HTTP. A REST API is the practical form that conversation often takes: resources with URLs, verbs with meaning, and JSON payloads exchanged by mobile apps, SPAs, and partners.
Because REST APIs are ubiquitous, their authorization, validation, and inventory problems dominate modern application risk.
Building blocks of a REST API
Resources and URIs
Nouns like /orders/123 identify entities clients interact with.
HTTP methods
GET reads, POST creates, PUT/PATCH update, DELETE removes—when used conventionally.
Representations
JSON (or XML) documents convey resource state to and from clients.
Stateless requests
Each call carries auth and context; servers avoid hidden client session coupling when possible.
Typical REST API request lifecycle
Client authenticates
Obtain a session cookie, API key, or OAuth access token.
Call a resource endpoint
Send method + path + headers + optional JSON body.
Gateway and app validate
Authn, schema, rate limits, and routing execute.
Authorize the object and action
Enforce BOLA/BFLA/BOPLA rules for that resource method.
Apply business logic
Persist changes or assemble a representation.
Return status and body
Use meaningful HTTP status codes and filtered JSON fields.
REST API vs other styles
| Style | Interface shape | Security focus |
|---|---|---|
| REST API | Many resource endpoints | Per-route and per-object authz |
| GraphQL | Single endpoint, flexible queries | Field authz, complexity, depth |
| RPC-style HTTP | Action endpoints (/doThing) | Function-level authorization |
| gRPC | Protobuf service methods | mTLS, proto validation, authz |
REST API security checklist
- Authenticate every non-public endpoint; authorize every object action.
- Validate request schemas and reject unexpected properties.
- Return least-privilege response DTOs to avoid excessive exposure.
- Document the API with OpenAPI and keep inventory current.
- Apply rate limits and pagination caps on collection endpoints.
- Use TLS everywhere; protect tokens and keys in clients.
- Version deliberately and retire vulnerable legacy routes.
- Test for BOLA/BFLA/BOPLA on each resource systematically.
The practical takeaway
A REST API is a resource-oriented HTTP interface used across the internet. Architectural purity matters less than consistent authentication, object authorization, validation, and inventory.
For the underlying architectural constraints, see Representational State Transfer (REST). For endpoint-level security testing, start with BOLA and related API authorization failures.
Related security terms
Representational State Transfer (REST)
The architectural style that REST APIs approximate.
API Endpoint
The callable HTTP operation that composes a REST API.
OpenAPI Specification
Standard contract format commonly used to describe REST APIs.
GraphQL
Alternative API style with client-specified query shapes.
Broken Object-Level Authorization (BOLA)
Frequent REST API authorization failure on resource IDs.
Frequently asked questions
What is a REST API in simple terms?
It is a web API where each important thing—users, orders, files—has a URL, and you use HTTP methods to read or change those things, usually sending JSON.
Is every JSON-over-HTTP API RESTful?
No. Many “REST APIs” are pragmatic HTTP APIs. True REST follows constraints like uniform interface and resource orientation more strictly.
How do REST APIs typically authenticate?
Common patterns include OAuth bearer tokens, API keys, session cookies, and mTLS for service clients.
What makes REST APIs hard to secure?
Many endpoints and object IDs create a large authorization surface; each method on each resource needs consistent checks.
REST API vs GraphQL—which is safer?
Neither is inherently safer. Risk depends on authorization, validation, and abuse controls—not the query style alone.
What documentation format is common?
OpenAPI (Swagger) is the most widely used contract format for REST-style HTTP APIs.
Are idempotent methods important?
Yes for reliability. PUT and DELETE semantics help clients retry safely when designed correctly.
References
Explore authoritative guidance and frameworks related to rest api.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.