REST API

What it means

A REST API is a way of building a web API in which each thing, such as a customer or an order, has its own address, and standard HTTP verbs act on it. GET reads, POST creates, PUT or PATCH changes and DELETE removes. Data usually travels as JSON.

REST is a design style, not a security feature or a strict standard. Two APIs can both call themselves REST and still behave quite differently. That is why security checks must look at what each individual API actually does, route by route and verb by verb.

Why it matters

Most modern products expose a REST API to their web app, mobile app and partners. Because the addresses are predictable, such as /orders/123, they are easy to explore and easy to misuse. One missing check on one verb can expose a whole collection of records.

The frequent failures are well known: a record returned to the wrong account, an admin function open to ordinary accounts, and responses that carry more fields than the screen shows. Each is a business problem as well, because the data in question belongs to your customers.

How it shows up

You meet a REST API in browser network traffic, in mobile app calls and in the documentation you give partners. Typical mistakes include checking authorisation on GET but forgetting PUT or DELETE, trusting an id in the URL, and allowing verbs nobody intended. See function-level authorisation and BOLA.

To review one, list every route and verb, then test each with accounts that should be refused. Compare what each response returns against what the screen needs. Check that errors reveal little, that limits exist, and that old versions are gone or protected the same way as the new.