gRPC vs. REST vs. GraphQL: choosing the right API protocol for scale

When designing modern distributed applications, engineering teams face a fundamental architecture question: How should services and clients communicate?

The three dominant API standards—REST, GraphQL, and gRPC—are optimized for completely different network topologies, client environments, and performance constraints.

API PARADIGM COMPARISON:
┌─────────────────┬──────────────────────┬────────────────────────┬──────────────────────┐
│ Protocol        │ Data Format          │ Transport              │ Best Suited For      │
├─────────────────┼──────────────────────┼────────────────────────┼──────────────────────┤
│ REST            │ JSON / XML           │ HTTP/1.1 or HTTP/2     │ Public APIs & Web    │
│ GraphQL         │ JSON                 │ HTTP/1.1 POST          │ Mobile & Aggregation │
│ gRPC            │ Protocol Buffers     │ HTTP/2 (Multiplexed)   │ Microservice Mesh    │
└─────────────────┴──────────────────────┴────────────────────────┴──────────────────────┘

---

1. REST (Representational State Transfer)

REST has served as the backbone of web APIs for more than two decades. It treats system entities as stateless resources identified by URIs and operated on using standard HTTP methods (GET, POST, PUT, DELETE).

HTTP/1.1 GET /api/v1/users/42
Host: api.example.com

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: max-age=3600

{
  "id": 42,
  "name": "Alice Johnson",
  "email": "alice@example.com",
  "role": "admin",
  "created_at": "2026-01-15T08:30:00Z"
}

Advantages

• Ubiquitous Compatibility: Any client (web browser, curl, mobile device, IoT) can make standard HTTP requests without specialized SDKs.
• Edge Caching: Intermediate CDNs and reverse proxies (Cloudflare, Fastly, Nginx) natively understand standard HTTP headers like Cache-Control and ETag to cache GET responses globally.
• Human-Readable Payloads: JSON payloads make development, logging, and debugging trivial in browser DevTools.

Disadvantages

• Over-Fetching: A mobile app needing only a user’s name must download 30 other unused fields returned by the endpoint.
• Under-Fetching (N+1 Calls): Fetching a user and their 10 recent orders requires making 1 request for the user, followed by 10 separate requests for the order details.

---

2. GraphQL (Client-Driven Query Language)

Created by Facebook in 2012, GraphQL flips the traditional API paradigm: instead of the server dictating the response structure, the client requests exactly what it needs.

# Single POST to /graphql
query GetUserProfile {
  user(id: 42) {
    name
    avatarUrl
    orders(limit: 3) {
      id
      total
      status
    }
  }
}

{
  "data": {
    "user": {
      "name": "Alice Johnson",
      "avatarUrl": "https://cdn.example.com/avatar42.png",
      "orders": [
        { "id": 101, "total": 49.99, "status": "DELIVERED" }
      ]
    }
  }
}

Advantages

• Zero Over-Fetching / Under-Fetching: Drastically reduces cellular bandwidth on mobile devices by sending only the exact requested fields.
• Single Round-Trip: Resolves nested relational data across multiple underlying databases or services in a single client request.
• Strongly Typed Schema Definition: Automatically generates strict TypeScript, Swift, or Kotlin types directly from the server schema.

Disadvantages

• Complex Edge Caching: Because almost all queries are sent as POST /graphql with dynamic request bodies, standard CDN HTTP caching does not work out of the box.
• Query Complexity & DoS Risk: Malicious or unoptimized deeply nested queries (e.g. user -> friends -> friends -> friends) can overwhelm backend databases without query cost analysis.

---

3. gRPC (High-Performance Remote Procedure Calls)

Engineered by Google, gRPC is a language-agnostic, high-performance RPC framework designed for internal backend-to-backend communication in high-throughput microservice meshes.

Protocol Buffers (Protobuf) Binary Serialization

Instead of human-readable JSON strings, gRPC compiles .proto contract schemas into dense binary encodings:

syntax = "proto3";

service UserService {
  rpc GetUser (UserRequest) returns (UserResponse);
}

message UserRequest {
  int32 id = 1;
}

message UserResponse {
  int32 id = 1;
  string name = 2;
  string email = 3;
}

JSON Representation:  {"id":42,"name":"Alice"}  ➔  24 bytes (Text string)
Protobuf Binary:      0x08 0x2a 0x12 0x05 0x41 0x6c 0x69 0x63 0x65  ➔  9 bytes (Binary)

Protobuf serialization and parsing is 7x to 10x faster than JSON, saving massive CPU time across billions of internal microservice requests.

HTTP/2 Transport & Multiplexing

gRPC communicates exclusively over HTTP/2:

• Multiplexing: Thousands of parallel RPC calls share a single persistent TCP connection, eliminating TCP 3-way handshake overhead and head-of-line blocking.
• Streaming: Native support for Server Streaming, Client Streaming, and Bi-directional Streaming for real-time telemetry and LLM token generation.

---

4. Architectural Selection Cheatsheet

┌────────────────────────────────────────────────────────┐
│                   Public Web & Mobile                  │
└───────────────┬────────────────────────┬───────────────┘
                │                        │
       [REST / OpenAPI]              [GraphQL]
   (Public Developers & SDKs)    (Mobile / Web Dashboard)
                │                        │
                ▼                        ▼
        ┌────────────────────────────────────────┐
        │          API Gateway (BFF)             │
        └───────────────────┬────────────────────┘
                            │
              [gRPC over HTTP/2 / Protobuf]
      (Internal High-Throughput Service Mesh)
                            │
         ┌──────────────────┼──────────────────┐
         ▼                  ▼                  ▼
   ┌───────────┐      ┌───────────┐      ┌───────────┐
   │ Auth Svc  │      │ Order Svc │      │ Paymt Svc │
   └───────────┘      └───────────┘      └───────────┘

1. Use REST for public developer APIs, third-party webhook integrations, and endpoints requiring heavy edge CDN caching.
2. Use GraphQL for complex mobile apps and frontend dashboards aggregating data from multiple backend services.
3. Use gRPC for all internal microservice-to-microservice communication, Kubernetes service meshes, and high-throughput streaming systems.