What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

CRUD and REST describe different layers of an application. CRUD is the set of data operations—create, read, update and delete. REST (Representational State Transfer) is an architectural style for communication between distributed systems. A REST API commonly exposes CRUD operations over HTTP, but CRUD is not REST, and an API can use CRUD without satisfying REST’s full constraints.

CRUD and REST in one sentence

Think of CRUD as what your application does to data and REST as how a distributed application organizes and communicates about resources. A database repository, service layer or command handler can implement CRUD without using HTTP at all. REST, by contrast, concerns resource representations, a uniform interface and constraints such as statelessness, cacheability and layered communication.

This distinction prevents a common design mistake: assuming that an endpoint becomes RESTful merely because it uses JSON, nouns in URLs or HTTP verbs. Those conventions are useful, but REST is broader and stricter.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What CRUD means

CRUD is the conventional shorthand for four persistence operations:

  • Create: add a new record or resource.
  • Read: retrieve one record, a collection or a representation of either.
  • Update: change an existing record or resource.
  • Delete: remove an existing record or resource.

CRUD can exist entirely inside an application. For example, a user-management service may expose functions named createUser, findUser, updateUser and deleteUser while talking directly to a database. Nothing about CRUD requires a network, HTTP, resource URLs or a particular data format.

CRUD also does not cover every domain action. “Approve invoice,” “send invitation” and “calculate shipping” are commands or business operations, even if they eventually change stored data.

What REST means

REST is an architectural style described by Roy Fielding for distributed systems. It models interaction around resources and their representations and uses constraints intended to improve scalability, visibility and evolvability.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The principal REST constraints

  • Client–server separation: the user interface and data-storage responsibilities evolve independently.
  • Statelessness: every request contains the information needed to process it; the server does not rely on hidden conversational session state between requests.
  • Cacheability: responses indicate whether they may be reused, allowing caches and intermediaries to reduce repeated work.
  • Uniform interface: resources are identified consistently, representations have predictable semantics, and standard methods and media types carry shared meaning.
  • Layered system: a client need not know whether it is connected directly to the origin service or through proxies, gateways and other intermediaries.
  • Code-on-demand (optional): a server may send executable code to extend client behavior.

Hypermedia as the engine of application state (HATEOAS) is part of the uniform-interface constraint. A response can expose links or other controls that tell a client which actions are currently available, rather than requiring the client to hard-code every next URL.

REST is not a data format

REST does not require JSON. JSON, XML, HTML and other representations can all be used. Likewise, a JSON endpoint can be RPC-style, stateful or otherwise non-RESTful.

How CRUD maps to HTTP

HTTP methods provide a common way to express CRUD intent. The mapping below is conventional, not a definition of REST itself.

CRUD intent Common HTTP method What the method means Important caution
Create a new resource POST Submit data for resource-specific processing, often resulting in a new resource. Generally non-idempotent: repeating the request can create multiple resources.
Read a resource or collection GET Retrieve a representation of the target. Safe: it is intended not to change server state.
Replace a resource PUT Store a complete representation at the target URI. Idempotent: repeating the same request has the same intended effect.
Partially update a resource PATCH Apply a set of partial modifications. Idempotency depends on the patch operation and implementation.
Delete a resource DELETE Remove the target resource. Defined as idempotent in HTTP semantics, although responses can differ between attempts.

HTTP’s method semantics matter independently of CRUD labels. For example, using GET to trigger a deletion violates the expectation that GET is safe and can cause caches, crawlers or prefetchers to perform destructive work.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

An illustrative resource-oriented API

The following is an example design for users. The URI shapes are illustrative; REST does not mandate /users or any other particular naming scheme.

  1. POST /users creates a user and commonly returns 201 Created, perhaps with a Location header for the new resource.
  2. GET /users retrieves a collection representation.
  3. GET /users/123 retrieves user 123, returning 404 Not Found when it does not exist.
  4. PUT /users/123 replaces the complete representation of user 123.
  5. PATCH /users/123 changes selected fields.
  6. DELETE /users/123 removes user 123 and may return 204 No Content.

A domain action can still be modeled explicitly. For example, approving an invoice might be represented as a state transition on an invoice resource or, where appropriate, as a clearly named action endpoint. It is not necessary to force every business behavior into a simplistic CRUD noun.

Why verbs and URLs alone do not make an API RESTful

An API that offers GET, POST, PUT and DELETE may be a well-designed HTTP API while falling short of Fielding’s REST style. Check the broader constraints.

Resource modeling

Stable resource identifiers and representations should be meaningful independently of a single database table. A URI should identify a resource, not expose implementation details such as SQL statements or temporary session keys.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Stateless requests

Authentication credentials and other request context must travel with each request. Server-side storage of a login session is not automatically disqualifying, but the processing of a resource request should not depend on an undisclosed conversation history.

Correct semantics and status codes

Use methods according to their standardized meaning and select status codes that communicate the result. A successful request, validation failure, authorization failure and missing resource should not all be reported as 200 OK.

Caching and intermediaries

Responses should make caching decisions possible through HTTP metadata where caching is appropriate. Gateways, proxies and CDNs should be able to participate without understanding private server state.

Hypermedia and discoverability

At the highest level of the Richardson Maturity Model, representations include links or controls for legal next actions. A client might receive an invoice with links to view, approve or cancel it based on its current state. Without such controls, clients must learn the workflow out of band.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Richardson Maturity Model versus strict REST

The Richardson model is a practical way to discuss API maturity, not a replacement for Fielding’s definition.

Level Characteristic
0 One endpoint or URI, often using POST for every operation.
1 Distinct URIs identify different resources.
2 HTTP methods and status codes carry their intended semantics.
3 Responses use hypermedia controls to guide available actions.

Many production APIs are level 2 and are still colloquially called REST APIs. Strictly speaking, REST also requires the other architectural constraints, and level 3’s hypermedia is the clearest practical expression of the uniform interface.

CRUD API versus REST API: practical comparison

Question CRUD-focused design REST-oriented design
Primary concern Represent create, read, update and delete work. Communicate about resources through a constrained, uniform interface.
Where it can run Database, library, service or API. Distributed client–server system.
URI requirement None. Resources are identified consistently, commonly with URIs.
HTTP requirement None. Often HTTP, with method semantics used correctly.
State requirement Not specified. Requests are intended to be stateless.
Discoverability Not specified. May include hypermedia controls; strict REST treats this as part of the uniform interface.

Can an API be CRUD without being RESTful?

Yes. An API might expose POST /doEverything with an operation field, keep hidden server session state and return JSON. It can still perform CRUD, but it does not follow the resource, method, statelessness and uniform-interface constraints associated with REST.

Does REST always mean CRUD?

No. REST can represent searches, workflows, state transitions and other domain interactions. CRUD is a useful subset of resource operations, not the complete vocabulary of a REST API.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How to evaluate an API design

  • Operation coverage: Are create, read, update and delete needs explicit, and are non-CRUD business actions modeled clearly?
  • Resource design: Do stable URIs and representations describe domain resources rather than database mechanics?
  • HTTP correctness: Are method safety, idempotency and status-code semantics respected?
  • State handling: Can each request be understood without hidden conversational state?
  • Caching: Do headers and representations permit appropriate standard caching?
  • Intermediaries: Can proxies, gateways and caches operate without private knowledge of the service?
  • Discoverability: Do responses expose links or controls when clients need guidance through a workflow?

Common mistakes and fixes

Calling every JSON endpoint REST

Problem: JSON describes representation syntax, not architecture. Fix: assess resource modeling, statelessness, method semantics, caching and discoverability.

Using POST for every operation

Problem: clients and intermediaries lose the standardized meaning of HTTP methods. Fix: use GET for safe retrieval, PUT for replacement, PATCH for partial changes and DELETE for removal; reserve POST for resource-specific processing or creation.

Treating PUT and PATCH as synonyms

Problem: a partial payload sent to a replacement endpoint can erase omitted fields. Fix: document whether PUT requires a complete representation and define the patch format and idempotency behavior.

Turning every command into a fake noun

Problem: awkward resources obscure business meaning. Fix: model genuine state transitions and domain actions explicitly while retaining correct HTTP semantics.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Or skip the browser setup

If you need screenshots of an API documentation page or resource representation while building or testing an HTTP service, ScreenshotNeo provides a single GET request. It accepts consent banners as a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets before capture; those steps can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients.

Example with cURL (see the ScreenshotNeo documentation for all options):

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

Python:

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

Node.js:

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

The Free plan includes 1,000 screenshots per month with no card. Paid plans start at $5 for 3,000 screenshots, and every feature is included on every plan. Create a free ScreenshotNeo account.

Bottom line

CRUD names four operations on data. REST defines an architectural approach for distributed communication about resources. A REST-style API often maps POST, GET, PUT, PATCH and DELETE to CRUD intents, but correct verbs and attractive URLs are only part of the test. Evaluate the complete design: resource representations, statelessness, cacheability, layered operation, status-code and method semantics, and—at the highest maturity level—hypermedia controls.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

Is CRUD a design pattern?

CRUD is a conventional operation vocabulary rather than one mandatory implementation pattern. It can be implemented in a database layer, service, command handler or network API.

Is GraphQL CRUD or REST?

GraphQL can support CRUD behavior, but its query and mutation model is different from REST’s resource-oriented HTTP interface. Calling it CRUD describes operations, not its architecture.

Should every update endpoint support both PUT and PATCH?

No. Choose the method that matches the contract: PUT for complete replacement and PATCH for partial modification. Supporting both is useful only when clients need both semantics and you can document them precisely.

Can REST use a database session?

REST’s stateless constraint concerns request processing: each request should contain the context needed to understand it. A backend may use database connections or other internal state without exposing a hidden client conversation.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.