What is REST API?
Quick definition
An architectural style for building web services using HTTP methods to perform CRUD operations on resources identified by URLs, enabling client-server communication.
REST (Representational State Transfer) is an architectural pattern for designing networked applications, particularly web services. It leverages standard HTTP methods—GET, POST, PUT, DELETE, PATCH—to operate on resources uniquely identified by URLs or URIs. A REST API treats data as resources and uses HTTP verbs to perform Create, Read, Update, and Delete (CRUD) operations, making it intuitive and scalable for developers.
REST APIs are stateless, meaning each request contains all necessary information for the server to process it without relying on previous requests. This statelessness improves scalability, reliability, and simplifies caching. Responses are typically formatted in JSON or XML, with appropriate HTTP status codes (200, 404, 500, etc.) indicating operation outcomes. REST has become the de facto standard for web API design due to its simplicity, alignment with HTTP semantics, and widespread tooling support.
In AI and MCP contexts, REST APIs serve as the primary integration mechanism for connecting agents, tools, and external services. AI agents make REST API calls to fetch data, trigger workflows, or interact with third-party systems. This enables autonomous agents to perform real-world actions while maintaining security through authentication mechanisms like API keys, OAuth, and bearer tokens.
Example
How it shows up in practice
GET /api/users/123 retrieves user with ID 123; POST /api/tasks creates a new task with JSON payload; PUT /api/tasks/456 updates task 456; DELETE /api/tasks/789 removes task 789.
Frequently asked questions
How does REST differ from other API styles like GraphQL or RPC?
REST uses standard HTTP methods and resource-based URLs, while GraphQL allows flexible querying of specific fields, and RPC-style APIs call specific functions. REST is simpler for CRUD operations; GraphQL excels at reducing over-fetching; RPC suits function-driven interactions.
What HTTP status codes should a REST API return?
Use 200 for success, 201 for resource creation, 204 for no content, 400 for bad requests, 401 for authentication failure, 403 for forbidden, 404 for not found, and 500 for server errors.
Is REST suitable for real-time applications or AI agent interactions?
REST works well for discrete agent actions like data retrieval or task creation, but lacks real-time capabilities. For streaming responses, consider Server-Sent Events or webhooks alongside REST.
How do I secure a REST API?
Use HTTPS, implement authentication (API keys, OAuth, bearer tokens), validate inputs, apply rate limiting, use proper CORS policies, and follow principle of least privilege for permissions.