We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningFoundation · Core Fundamentals
An architectural style for building APIs using standard HTTP methods (GET, POST, PUT, DELETE). Resources are identified by URLs.
In short
A REST API is a way to build web APIs where every piece of data is treated as a resource with its own URL, and clients act on those resources using standard HTTP methods: GET to read, POST to create, PUT or PATCH to update, and DELETE to remove. Each request carries everything the server needs to handle it, so the server stores no client session between calls.
In short
A REST API is a way to build web APIs where every piece of data is treated as a resource with its own URL, and clients act on those resources using standard HTTP methods: GET to read, POST to create, PUT or PATCH to update, and DELETE to remove. Each request carries everything the server needs to handle it, so the server stores no client session between calls.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers REST API across a run of lessons, not one page. These 4 alone are about 135 minutes of step-by-step reading, 2 of them with code you run in the browser, all with a quiz.
Standard web service architecture using HTTP methods and resource-based URLs.
What does a catalog like Unity Catalog do that a folder cannot? I put 3,475,226 NYC taxi trips behind three real catalogs: an Iceberg SQL catalog, the Apache Iceberg REST catalog and Unity Catalog OSS 0.6.0. A rename sent one SQL UPDATE and moved 0 of 9 files, while moving the folder broke a reader after 1 of 10 files. A writer that crashed before its swap left a newest metadata file with 123,646 trips nobody committed. Two catalogs on one folder both accepted writes and disagreed. Unity Catalog refused a user with no grants, but the same user read every row straight from the folder.
Managing user sessions across multiple servers, sticky sessions, centralized stores, and token-based approaches.
Using HTTP cookies to maintain user state across requests, the traditional session model.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with REST APIpay once,
yours for life
REST stands for Representational State Transfer. It is a set of conventions for designing HTTP APIs, described by Roy Fielding in his 2000 PhD dissertation. It is not a protocol or a library you install. It is an agreement about how URLs and HTTP methods should be used so that any client can talk to any server without surprises.
The core idea is the resource. A user, an order, a blog post, a payment are all resources. Each one gets a URL, called a URI. For example, GET /users/42 returns user 42, and DELETE /users/42 deletes that same user. The plural noun in the path (/users) names a collection, and the id picks one item out of it.
What comes back is a representation of the resource, usually JSON today, though XML was common in the early years. The client never touches the server's internal storage directly. It only ever sees and edits these representations, which is where the name Representational State Transfer comes from.
A REST call is just an HTTP request. The method (verb) says what to do, the path says which resource, headers carry metadata like Content-Type and Authorization, and the body carries data for writes. The server replies with a status code, response headers, and usually a JSON body.
Status codes carry real meaning and clients are expected to read them: 200 OK for a successful read, 201 Created after a POST that made something new, 204 No Content for a successful delete, 400 for a bad request, 401 when you are not authenticated, 403 when you are not allowed, 404 when the resource does not exist, and 500 when the server broke.
REST is stateless. The server keeps no memory of previous requests, so every call must include its own authentication token and any context it needs. This is what lets you run hundreds of identical API servers behind a load balancer: any server can handle any request because none of them hold session state. Several HTTP methods are also idempotent by design, meaning GET, PUT, and DELETE produce the same end result whether you call them once or five times, which makes safe retries possible.
Good REST APIs lean on HTTP features instead of reinventing them: caching through ETag and Cache-Control headers, content negotiation through the Accept header, and partial reads through query parameters like /users?role=admin&limit=50.
REST is the default choice for public web and mobile APIs because it is simple, readable in a browser address bar, cacheable by ordinary HTTP infrastructure, and understood by every HTTP client and tool. Stripe, GitHub, and Twilio all ship REST APIs because any developer can start using them with curl in minutes.
The main weakness is over-fetching and under-fetching. A mobile screen that needs a user's name plus their last three orders might have to call /users/42, then /users/42/orders, then loop over each order. GraphQL solves that with a single tailored query, which is why Facebook built it. For high-throughput service-to-service traffic, gRPC with binary Protocol Buffers is faster than JSON over REST.
REST also has no built-in contract. Two endpoints can return inconsistent shapes unless the team enforces standards, so most serious APIs publish an OpenAPI (Swagger) specification to document and validate the contract. Despite these limits, REST remains the most widely deployed API style on the public internet.
Imagine a simple to-do app. To list all tasks the client sends GET /tasks and gets back 200 with a JSON array. To create one it sends POST /tasks with a body like a title and a done flag, and the server replies 201 Created plus the new task including its generated id, say /tasks/7.
To mark task 7 complete the client sends PUT /tasks/7 with the full updated object, or PATCH /tasks/7 with just the changed field. To remove it the client sends DELETE /tasks/7 and gets 204 No Content. Notice that the same path, /tasks/7, supports read, update, and delete depending only on the HTTP method.
Every one of those calls is self-contained. The request carries an Authorization header with a bearer token, the server validates it, acts on the resource, and forgets the client the moment it responds. That statelessness is what makes REST APIs straightforward to scale and cache.
Stripe
Its payments platform is a REST API where charges, customers, and subscriptions are resources acted on with standard HTTP verbs and JSON.
GitHub
The GitHub REST API exposes repos, issues, and pull requests as resources under api.github.com, used by countless integrations and CI tools.
Twilio
Sending an SMS is a POST to a Messages resource, with delivery status read back via GET, all over plain HTTP.
Amazon S3
The S3 API is REST over HTTP: PUT to upload an object, GET to download it, DELETE to remove it, with buckets and objects addressed by URL.
HTTP is the underlying protocol that moves requests and responses across the web. REST is a set of design conventions for using HTTP well, mainly mapping resources to URLs and operations to HTTP methods. Every REST API runs on HTTP, but not every HTTP API follows REST conventions.
No. JSON is just the most common format REST APIs use to represent resources. REST itself says nothing about format, and early REST APIs often used XML. You can technically return JSON, XML, or other formats and still be RESTful.
It means the server keeps no memory of past requests from a client. Each request must carry everything needed to process it, including its authentication token. This lets you run many interchangeable server instances behind a load balancer, since any one of them can handle any request.
Use GraphQL when clients need flexible, tailored queries and you want to avoid over-fetching across many endpoints, common in complex mobile and web frontends. Use gRPC for fast internal service-to-service calls where binary efficiency and strict contracts matter more than browser-readable URLs. REST stays the best default for public, cacheable, broadly compatible APIs.
GET reads a resource, POST creates a new one, PUT replaces a resource entirely, PATCH updates part of it, and DELETE removes it. GET, PUT, and DELETE are idempotent, meaning repeating the same call leaves the system in the same final state.
HTTP
The protocol powering the web. A request-response model where clients ask for resources and servers respond. Stateless by design.
GraphQL
A query language for APIs where the client specifies exactly what data it needs. No over-fetching, no under-fetching. One endpoint to rule them all.
gRPC
A high-performance RPC framework by Google using Protocol Buffers and HTTP/2. Much faster than REST for service-to-service communication.
API Gateway
A single entry point for all client requests that routes them to the appropriate microservice. Handles auth, rate limiting, and request transformation.
Latency
The time delay between sending a request and getting a response. Amazon found every 100ms of extra latency costs 1% in sales.
Throughput
The number of operations a system can handle per unit of time. Think of it as how many cars a highway can move per hour.
This page explains the idea. The "REST API" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the REST API lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about REST API in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
