Recommended Free Tools
HTTP is a protocol; REST is an architectural style. An API can send JSON over HTTP and use resource-shaped URLs without satisfying REST’s broader constraints. To design or evaluate an API well, follow HTTP’s defined method and status semantics, then consider whether the overall architecture follows REST principles.
What HTTP and REST mean
HTTP is a stateless application-level protocol for distributed, collaborative hypertext information systems. RFC 9110, the IETF Standards Track specification published in June 2022, defines semantics shared across HTTP versions. HTTP/1.1, HTTP/2, and HTTP/3 use those shared semantics while differing in message syntax, framing, and transport details.
As an Amazon Associate I earn from qualifying purchases.
REST means Representational State Transfer. Roy Fielding introduced it as an architectural style for distributed hypermedia in his 2000 UC Irvine dissertation. HTTP and REST are related, but not interchangeable: using HTTP does not by itself make a service RESTful.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Concept | What it is | What it helps answer |
|---|---|---|
| HTTP | A protocol with shared request and response semantics. | What does a method mean? What does a status code communicate? |
| REST | An architectural style defined by interacting constraints. | How are components organized, and how do they interact and evolve? |
HTTP interactions concern resources identified by URIs and representations that convey information about resource state in a chosen format. A representation is not necessarily a literal file or a byte-for-byte copy of an internal server object. This separation lets a service hide its implementation behind representations and, where appropriate, negotiate among formats.
How to choose HTTP methods
Methods are not arbitrary labels for application functions. Use their defined semantics so that clients, servers, caches, and intermediaries can interpret requests consistently. The protocol defines the method’s general meaning; an API still needs to specify its own resource behavior and rules.
| Method | Standard meaning | Safe? | Idempotent? |
|---|---|---|---|
| GET | Request transfer of a current selected representation. | Yes | Yes |
| HEAD | Like GET in response semantics, but without response content; useful for checking metadata. | Yes | Yes |
| POST | Ask the target resource to process the enclosed representation according to its own semantics. | No | No, not by definition |
| PUT | Request that the target resource create or replace its state with the enclosed representation, subject to server rules. | No | Yes |
| DELETE | Request removal of the association between the target resource and its current functionality. | No | Yes |
| OPTIONS | Ask about communication options for the target resource or server. | Yes | Yes |
POST is broader than “create”: it delegates processing to the target resource’s semantics. PATCH is defined in a separate specification, not in RFC 9110’s standard-method list, so its detailed meaning should be taken from that specification and the API’s own documentation.
Safe and idempotent are different
Safe describes a method whose defined semantics are essentially read-only. RFC 9110 classifies GET, HEAD, OPTIONS, and TRACE as safe. That does not prohibit incidental effects such as logging; it means the client is not asking for a state change through the method’s defined purpose.
Rank #2
Idempotent means that repeating an identical request has the same intended effect on the server as making it once. PUT and DELETE are idempotent but unsafe: they request changes, yet repeating them should not compound the intended effect. The response to a later DELETE, for example, need not be identical to the first response.
These properties matter when a client encounters a communication failure. RFC 9110 permits retries of idempotent requests in certain failure cases, because repeating them has the same intended effect. A client should not automatically retry a non-idempotent request unless it can determine that the original action was not applied or otherwise establish that repeating it is safe. “The request failed” alone does not establish that the server did nothing.
How to interpret status codes
The first digit of an HTTP status code identifies its class. Clients should understand the class even when they do not recognize a valid specific code.
| Class | Meaning |
|---|---|
| 1xx | Informational |
| 2xx | Successful |
| 3xx | Redirection |
| 4xx | Client error |
| 5xx | Server error |
Applications should make decisions from the status code and other defined response fields, not from the reason phrase, which is not the reliable machine-readable part of the response. For API design, choose a status that communicates the outcome using HTTP’s semantics rather than inventing meaning for a code outside its intended class.
When HTTP responses can be cached
HTTP caching depends on method semantics and cache controls; it is not automatic. GET and HEAD responses are cacheable subject to the relevant controls. POST responses can be cacheable only under specified conditions. A GET response is not necessarily suitable for sharing among users or contexts: cache directives and request context still govern whether reuse is appropriate.
In REST, cacheability is an architectural constraint intended to let responses be reused when their semantics permit it. Correct cache behavior can reduce repeated work, but a mistaken cache policy can serve an inappropriate or stale representation. Treat cache directives as part of API behavior, not as an optional performance toggle.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What makes an API RESTful
Fielding describes REST through six constraints: client-server, stateless interaction, cache, uniform interface, layered system, and code-on-demand. Code-on-demand is optional in the dissertation’s derivation. REST is therefore more than a set of URL conventions or a choice of data format.
Client-server and stateless interaction
Client-server separation gives clients and servers distinct responsibilities. Stateless interaction means each request can be understood without relying on hidden conversational state retained from earlier requests. It does not mean a server cannot store resource data; it means the interaction’s context is not silently carried only in server-side session state.
Cache and uniform interface
The cache constraint allows responses to be reused when they are explicitly cacheable. The uniform interface is REST’s defining feature: it standardizes how components communicate, making interactions more visible and allowing implementations to evolve independently behind representations. As Fielding puts it, “The central feature that distinguishes the REST architectural style from other network-based styles is its emphasis on a uniform interface between components.”
Uniformity has a trade-off: a general interface can be less efficient than one tailored to a single application. Resource-oriented paths and correct method use can contribute to a uniform interface, but they do not alone establish that the full set of REST constraints is met. JSON is one possible representation format, not REST’s definition.
Layered system and code-on-demand
A layered system allows intermediaries such as proxies, gateways, and firewalls to participate without changing the interfaces between components. Layers can enable reuse and intermediary processing, but may add overhead and latency. Code-on-demand allows a server to extend client functionality by transferring executable code; Fielding treats it as optional.
A practical way to assess an API
When designing or reviewing an API, check whether its behavior is coherent across the protocol and architecture:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Resources and representations: Can you identify the resources, and do their representations convey the information clients need without exposing internal implementation details?
- Method and status semantics: Does each method’s standard meaning fit the requested action, and does the response status communicate the outcome accurately?
- Retries: If a client loses the connection, can it safely repeat the request based on the method’s intended effect and the API’s documented behavior?
- Caching: Are responses cacheable only where appropriate, with controls that reflect their intended reuse?
- Request context: Can each request be understood on its own, rather than depending on undocumented hidden session state?
- Discoverability: Where useful, do representations and links help clients navigate available actions, rather than requiring every interaction to be inferred from out-of-band knowledge?
- Intermediaries: Do layers improve reuse and processing enough to justify their complexity and possible latency?
Not every API needs to optimize every REST constraint equally. The useful distinction is whether a design deliberately adopts the style’s constraints and trade-offs, rather than assuming that HTTP plus JSON makes it REST.
Quick Recap
Primary sources
- RFC 9110: HTTP Semantics, IETF Standards Track, June 2022.
- Roy Thomas Fielding, Architectural Styles and the Design of Network-based Software Architectures, UC Irvine doctoral dissertation, 2000.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
