Modern API Protocols: Beyond REST

title: Modern API Protocols - gRPC and GraphQL description: Explore high-performance and flexible API protocols that go beyond REST, including gRPC and GraphQL.

Modern API Protocols: Beyond REST

Adapted from Mastering System Design from Basics to Cracking Interviews (Udemy) — https://www.udemy.com/course/mastering-system-design-from-basics-to-cracking-interviews/

Why Do We Need More Than REST?

While REST is the industry standard, it has inherent limitations in specific scenarios:

• Over-fetching & Under-fetching: Clients often get more data than they need (over-fetching) or have to make multiple requests to get related data (under-fetching).
• Latency: Text-based JSON is larger and slower to parse than binary formats.
• Protocol Overhead: Traditional HTTP/1.1 requires a new connection or head-of-line blocking for multiple requests.
• Microservices Complexity: Managing hundreds of REST endpoints across services can be a maintenance nightmare.

gRPC: High-Performance Binary Protocol

gRPC (Google Remote Procedure Call) is an open-source high-performance RPC framework that can run in any environment. It is designed for low-latency, high-throughput communication, especially between microservices.

How It Works:

• Built on HTTP/2: Uses multiplexing, header compression, and full-duplex streaming.
• Protocol Buffers (ProtoBuf): A language-neutral, platform-neutral, extensible mechanism for serializing structured data. It's binary, making it much smaller and faster than JSON.
• Strongly Typed Contracts: Defined in .proto files, which auto-generate client and server stubs in multiple languages.

Use Cases:

• Microservices: Fast inter-service communication.
• Real-time Streaming: Bidirectional data transfer.
• IoT & Low-Bandwidth: Efficient binary communication for edge devices.

GraphQL: Flexible Query Language

GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data. It provides a complete and understandable description of the data in your API.

How It Works:

• Single Endpoint: Unlike REST's multiple endpoints, GraphQL usually exposes a single /graphql endpoint.
• Client-Specified Queries: Clients specify exactly what fields they need.
• Schema & Type System: A strictly defined schema provides a clear contract between frontend and backend.
• Dynamic Resolution: The server resolves each field dynamically, often aggregating data from multiple databases or services in a single round-trip.

REST vs. gRPC vs. GraphQL

Interview Questions & Answers: Beyond REST

1. How would you compare REST, gRPC, and GraphQL?

• REST is best for simple, standardized APIs with broad public adoption. However, it suffers from over-fetching/under-fetching.
• gRPC is the go-to for performance-sensitive microservices. It's incredibly fast due to its binary format but harder to consume directly from browsers.
• GraphQL excels in frontend-heavy apps where the client needs high flexibility to query specific data shapes, reducing the number of API round-trips.

2. When would you use gRPC over REST?

Use gRPC when efficiency is the priority.

• Efficiency: Binary ProtoBuf is much smaller than text-based JSON.
• Streaming: gRPC has native support for bidirectional streaming.
• Type Safety: The .proto files act as a "Single Source of Truth" and auto-generate code.
• Internal Ops: It's ideal for communication between internal services where browser support isn't a limitation.

3. What are the trade-offs of using GraphQL in a large-scale system?

• Advantages: No over-fetching, single-request data aggregation, and a strongly typed schema.
• Trade-offs:
• Caching Complexity: Because queries are dynamic, standard HTTP/CDN caching is harder to implement.
• Performance Risk: Deeply nested queries can cause "N+1" database issues or heavy server load.
• Security: Arbitrary queries can be used for DoS attacks without rate limiting and query complexity depth-checks.

4. How does gRPC handle authentication & security?

• TLS Encryption: gRPC requires TLS 1.2+ for end-to-end encryption.
• mTLS: Mutual TLS is common in microservices to verify both client and server identity.
• Tokens: Pass JWT or OAuth tokens within the call's metadata.
• Interceptors: Use middleware to enforce role-based access control (RBAC) and rate limiting.

5. How do you scale GraphQL APIs efficiently?

• Federation: Split the schema into multiple "subgraphs" managed by a central gateway (e.g., Apollo Federation).
• DataLoader: Use batching to solve the N+1 problem.
• Query Complexity Limits: Limit how deep or expensive a query can be to prevent server abuse.
• Persisted Queries: Store large query strings on the server and have the client send a short hash instead, improving caching and performance.

Final Thoughts

Choosing between REST, gRPC, and GraphQL isn't about finding the "best" protocol, but the right tool for your specific architecture. Often, a modern system will use GraphQL for the frontend gateway and gRPC for high-speed internal service communication.