REST vs GraphQL vs gRPC vs SOAP: API Protocols Explained
01Introduction
An API protocol is the set of rules two systems follow to talk to each other: how a request is shaped, how it travels, and what comes back. The main types of API protocols today are REST, GraphQL, gRPC and SOAP, plus WebSockets and webhooks for real-time and event-driven work, and MCP, the newest one, built for AI agents.
REST is still the default. In Postman's State of the API survey, 89% of developers said they use REST, followed by webhooks (35%), SOAP (34%), GraphQL (28%), WebSockets (26%) and gRPC (11%) (Postman, 2022). Most teams use more than one.
This guide explains each protocol with one short example, compares them side by side, and ends with five questions to help you choose.
02API protocols at a glance
| Protocol | Data format | Runs over | Best for |
|---|---|---|---|
| REST | Usually JSON | HTTP | Public APIs, CRUD, most web and mobile apps |
| GraphQL | JSON | HTTP (one endpoint) | Front ends that need flexible, nested data |
| gRPC | Protocol Buffers (binary) | HTTP/2 | Fast service-to-service calls inside a backend |
| SOAP | XML | Usually HTTP | Banking, government, older enterprise systems |
| WebSockets | Any (often JSON) | One long-lived TCP connection | Chat, live dashboards, multiplayer |
| Webhooks | Usually JSON | HTTP POST from the provider | Getting notified when something happens |
| MCP | JSON-RPC 2.0 | stdio or HTTP | AI agents calling tools and APIs |
03REST: the default
REST (Representational State Transfer) was described by Roy Fielding in his 2000 dissertation. It treats everything as a resource with its own URL, and uses HTTP methods to act on it: GET to read, POST to create, PUT or PATCH to update, DELETE to remove.
Getting a user and their orders takes two requests:
GET /users/42
GET /users/42/ordersWhy teams pick it: every language and tool speaks HTTP, responses can be cached by URL, and it's easy to learn. It's also stateless, which makes it simple to scale.
Where it struggles: the server decides what each endpoint returns. You may get more fields than you need (over-fetching) or need several calls to build one screen (under-fetching).
04GraphQL vs REST
GraphQL was created at Facebook and open-sourced in 2015. Instead of many URLs, it has one endpoint, and the client sends a query describing exactly the data it wants.
The same user and orders in one request:
query {
user(id: 42) {
name
orders { id total }
}
}
The response matches the shape of the query, nothing more.
GraphQL vs REST, in practice:
- Fetching: REST returns fixed shapes from many endpoints. GraphQL returns exactly the requested fields from one.
- Schema: GraphQL APIs have a typed schema that clients can inspect. REST relies on separate documentation such as OpenAPI.
- Caching: REST caches easily by URL. GraphQL usually sends queries as
POSTto one URL, so caching needs extra work. - Errors: REST uses HTTP status codes like 400 and 405. GraphQL often returns
200 OKwith anerrorsarray in the body. - Performance risk: a deeply nested GraphQL query can trigger many database calls (the "N+1" problem) unless the server batches them.
Choose GraphQL when one front end needs data from many sources and the screens change often. Stay with REST for public APIs, simple CRUD and anything that benefits from HTTP caching.
05gRPC: fast calls between services
gRPC was open-sourced by Google in 2015. You define your service in a .proto file, and gRPC generates client and server code in most major languages. Data travels as Protocol Buffers, a compact binary format, over HTTP/2.
service UserService {
rpc GetUser (GetUserRequest) returns (User);
}Why teams pick it: small payloads, fast parsing, strict contracts, and streaming in both directions. It's popular for microservices that call each other thousands of times a second.
Where it struggles: browsers can't call gRPC directly. Web apps need gRPC-Web and a proxy in between, and the binary format isn't human-readable, so debugging needs dedicated tools.
gRPC vs REST: use gRPC inside your backend where speed matters, and REST at the edge where browsers, partners and third-party developers connect.
06SOAP: still running the banks
SOAP (Simple Object Access Protocol) is an XML-based standard from the late 1990s, maintained by the W3C. Every message is an XML envelope, and a WSDL file describes exactly what the service accepts.
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Body>
<GetUser><UserId>42</UserId></GetUser>
</soap:Body>
</soap:Envelope>Why it survives: strict contracts and built-in standards for security and reliable messaging (WS-Security, WS-ReliableMessaging). Payment networks, insurers and government systems still depend on it.
SOAP vs REST: SOAP is heavier and more verbose, and REST is simpler and faster to build with. You rarely choose SOAP for something new, but you'll meet it whenever you integrate with older enterprise systems.
07WebSockets and webhooks: real time and events
These two solve a problem the request-response protocols above don't: getting data without asking for it.
WebSockets (RFC 6455) keep one connection open, so either side can send messages at any time. Use them for chat, live prices, collaborative editing and games.
const ws = new WebSocket("wss://example.com/live");
ws.onmessage = (e) => console.log(e.data);Webhooks flip the direction: instead of you polling an API, the provider sends an HTTP POST to your URL when an event happens, such as a payment succeeding or a file finishing processing.
Rule of thumb: use WebSockets when a user is watching the screen and needs updates in under a second. Use webhooks when a server needs to react to events, even hours later.
08MCP: the protocol for AI agents
The Model Context Protocol (MCP), introduced by Anthropic in November 2024, is the newest entry on this list. It standardizes how AI assistants discover and call tools. An MCP server lists its tools with an input schema for each, and the agent calls them using JSON-RPC 2.0:
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "validate_email",
"arguments": { "email": "[email protected]" }
}
}MCP doesn't replace REST. In most cases it sits on top of it: the MCP server receives the tool call and makes the REST request for the agent. The benefit is the fixed schema, so the agent doesn't guess field names or improvise payloads. For a full introduction, see What is MCP? The Model Context Protocol in plain English.
This is how ApyHub works: every API in the catalog is a REST endpoint and also a tool on ApyHub MCP. Your code calls the REST API, and Claude, ChatGPT, Cursor or Mistral Le Chat call the same API as an MCP tool.
09Test every protocol in one client
Most teams end up with a mix: a REST API for partners, GraphQL for the front end, gRPC between services, a webhook or two, and now MCP. Switching between a different tool for each one slows debugging down.
Voiden is a free, open-source API client that handles all of them through plugins: REST, GraphQL, gRPC, WebSockets and more. You install only the protocols you use. Every request is saved as a plain Markdown .void file in your repository, so a GraphQL query and the gRPC call behind it can sit together in Git, next to the code they test.
10How to choose an API protocol
- Who calls the API? Outside developers and browsers: REST. Your own front end with complex data needs: GraphQL. Your own services: gRPC.
- Do you need real-time updates? A user watching the screen: WebSockets. A server reacting to events: webhooks.
- Are you integrating with an older enterprise system? You'll probably need SOAP, whatever you'd prefer.
- Does performance between services matter most? gRPC's binary format and HTTP/2 win.
- Will AI agents call it? Expose it through MCP so agents get a fixed schema instead of guessing.
11Conclusion
There's no best API protocol, only the right one for each connection. REST remains the safe default for anything public. GraphQL fits front ends with complex data needs, gRPC fits fast internal traffic, and SOAP is still there in banking and government. WebSockets and webhooks handle real time and events, and MCP is how AI agents now reach the same APIs. Most production systems use three or four of these at once.
Explore the ApyHub catalog, free to start →
12FAQ
What are the main types of API protocols?
REST, GraphQL, gRPC and SOAP are the main request-response protocols. WebSockets and webhooks handle real-time and event-driven communication, and MCP connects AI agents to tools and APIs.
What is the difference between REST and GraphQL?
REST exposes many endpoints, each returning a fixed shape. GraphQL has one endpoint where the client asks for exactly the fields it needs, often in a single request.
Is GraphQL better than REST?
Not in general. GraphQL is better when a front end needs flexible, nested data. REST is simpler, easier to cache and better for public APIs.
Is gRPC faster than REST?
Usually, yes. gRPC sends compact binary data over HTTP/2, while REST typically sends JSON text. The difference matters most for high-volume calls between services.
Is SOAP still used?
Yes, mainly in banking, insurance, payments and government systems. New public APIs are rarely built with SOAP.
Is MCP a replacement for REST?
No. MCP usually sits on top of REST APIs and gives AI agents a standard way to discover and call them with a fixed input schema.
What is the difference between WebSockets and webhooks?
WebSockets keep a two-way connection open for instant updates. Webhooks send a one-off HTTP request to your server when an event happens.
How can I test REST, GraphQL and gRPC APIs?
Use an API client that supports several protocols. Voiden supports them through plugins and saves every request as a Markdown file in your Git repository.
13About ApyHub
ApyHub is a curated API catalog and the trusted operational layer between your application and the services it depends on. One subscription, billed in atoms, covers the whole catalog of over 1,500 endpoints and capabilities, and it keeps growing. Every service is evaluated before it is listed and carries machine-readable certification covering GDPR, SOC 2 and ISO 27001. Every endpoint is MCP-ready by default. ApyHub runs dedicated EU and US regions and serves more than 65,000 developer workspaces every month. Start on the free tier with no card, or publish your own API on ApyHub.