Introspected REST: An Alternative to REST and GraphQL
introspected.rest
introspected.rest
- Sections 1-8 are a summary of REST, HATEOS, their problems, and reflections on the problem that every endpoint is `application/json` and not something more specific to the intended use case.
- Sections 9-11 discuss a variant of REST that doesn't use Media Type differentiation for capabilities, but rather composable nuggets of semantics called MicroTypes. The MicroType schemata is accessible through an introspection interface; one suggestion is to use (cacheable) OPTIONS. Clients would transmit their desired MicroTypes to an endpoint using the Accept-Type header.
If I'm reading this correctly, the author is suggesting the clients be allowed to specify the middleware chain used by the server to compose the response data (cf pagination, query, filter MicroTypes), and that these programmable chains are attached to every traditional REST endpoint collection. In one sense, this is an attempt to marry the resolver chain concept from GraphQL into the world of RESTish JSON APIs.
I think you could pull this off only with a dedicated server library because I don't see real world developers using this technique successfully on the current crop of HTTP webserver APIs. There's also the very real performance issues that come up when clients are allowed to control resolution; we see companies using GraphQL in production locking down the ability to do custom queries.
This is a feature, not a bug. If a JSON decoder can interpret the format, then it is by definition `application/json`. The alternative is to go back to miriads of incompatible data exchange formats, and each dev writing his own buggy parser, or installing yet another dependency to his application.
If it's the latter, as well as performance I'd be deeply concerned about security.
One thing GraphQL got right was focusing on the client tooling. If the client developers are bought in to the protocol/specification then the server developers will naturally come along. The reverse has not been true in my case.
This opinion is based on my experience building hypermedia APIs, consuming hypermedia APIs and helping with the HAL hypermedia spec.
What tech and languages do you guys use? And are you hiring?
I think we just wanted to show that it is possible to come up with a different (better we think) architecture other than REST and that's a big thing I think. Relevant answer: https://news.ycombinator.com/item?id=18425581
The first sentence of TFA captures one of the most annoying things about REST discussions: "In this manifesto, we will give a specific definition of what REST is, according to Roy, and see the majority of APIs and API specs (JSONAPI, HAL etc) fail to follow this model."
At this point I've read or heard dozens of claims like this, that almost everyone is doing REST wrong. It's well past time to stop blaming all the REST implementers in the world for being too dumb to understand Fielding's brilliant vision. If most software developers can't get REST right, then either proponents have consistently done a crappy job explaining the idea, or it's not as great an idea as they think.
Skimming the table of contents, it looks like the authors have thought deeply about the problems with REST and come up with some well-reasoned solutions. So they're answering the "REST vs Introspected REST" question. But much more relevant to me is the "Introspected REST vs GraphQL" question. What would make someone choose this over GraphQL? Introspected REST has a lot of catching up to do to match GraphQL's tooling and market share.
In the case of REST, it has been mistreated as SOA-WS for JSON or an RPC for SPAs... hardly anyone bothers with res links.
I would add that hardly anyone bothers with rdf json, while hurriedly reinventing the XML Schema horror movie ;)
Did you know WSDL has supported "REST"-like encoding of parameters in URLs and operations as HTTP verbs since 2001?
For instance, there were multiple different ways you could format your message (RPC/encoded, RPC/literal, Document/encoded, Document/literal, Document/literal wrapped) and different implementations supported different formats. There were all kinds of extra features that were never supported across board like multi-part messages etc.
Before WS-I there was practically zero guarantee that two SOAP implementations would ever be able to interoperate (and please remember, while REST has no standard in practice, it's dead simple to implement REST by hand - the same couldn't be say about SOAP!). WS-I only came out in 2004 or so, and by then it was already too late. I'd say the SOAP ecosystem is the definitive case study for trainwrecks.
If you really want a standard method for RPC then you're much better off with a modern implementation like gRPC or Thrift or Cap'n proto. Please don't go back to the nightmare called SOAP.
On the other hand SOAP is good match for such applications because it is simply an RPC mechanism, albeit with unnecesarily complex marshalling and transport layers underneath.
Why the hell would you wish that pain on anyone.
Except for undocumented "REST" APIs with totally arbitrary encodings of parameters into URL path steps and query parms, and needless excessive network roundtrips. Frameworks such as JAX-RS, Spring, and Swagger/Open API even invite you to use "subresources" as out-of-band agreed URL schemes ("lousy coupling"), totally missing the entire point of REST: that you dynamically learn interactions on "resources" via hyperlink URLs as a means for loose coupling.
3GPP for example have adopted it for several interfaces inside the 5G core network.
GET serviceRoot/People('russellwhyte')/Microsoft.OData.SampleService.Models.TripPin.GetFavoriteAirline()
is an absolute insult to REST and the target developer audience.https://www.odata.org/getting-started/basic-tutorial/#bounde...
For the most part, OData does a good job at letting folks opt into complexity, allowing integrators to make full use of APIs without needing to know anything about $metadata, inheritance mechanics, functions, etc.
So by saying "we're going to go with REST", you can determine about 90% of your API design more or less instantly, and it rarely gets in the way.
You still have to get your domain modeling right, and sometimes you need to make some extra resources. But you have a design that, basically, works.
Even for CRUD apps with simple master/detail data relationships it doesn't make sense to tie your domain design to network requests.
You mean like GraphQL? ;)
Then I read the actual documentation, and I felt like it was what I had been missing before.
Now I just need to find a decent implementation.
E.g. you can stick an off-the-shelf caching reverse proxy in front of a server.
E.g. you can split data centers and direct your hypermedia links there.
I think there are often more important things then just interoperability and flexibility, but those were the guiding principals of REST.
Most of the benefit of REST over SOAP was the fact that it used HTTP correctly instead of implementing a redundant protocol on top of it. Having machine-readable API contracts is still extremely valuable; we just found better ways of doing that.
It doesn't get you the "flexibility" of hypermedia/HATEOS, but it depends on your application if you need that. Most projects don't call for 15+ year APIs.
For example, our API needed a way to serve a different view of an existing model. How do I get the API to know which view to serve? When I asked around, they said the best way was to do /cars/1/prices, which I didn't like because I feel it breaks REST. There's no price model to the car, prices are fields of cars, at least for now.
I had to think for a few seconds before coming up with just using a query parameter to set which view to serve, /cars/1?view=pricelist, preserving REST. But most coders just take the first thing that comes to mind, and then wonder why their applications are so messy after a few years.
Coders seem to not want to bother learning how existing solutions are supposed to work before jumping to a half-baked newer solution just because it seems more intuitive. If you understand REST, then you can see how GraphQL can improve certain aspects of API interaction.
But it's not a panacea any more than React is. If you understood how HTML, CSS, and Javascript are supposed to work, then you can see how React improves on it. But if you can't then your React applications will be just as horrendous as your jQuery ones were.
For starters, a lot of people are looking for a TL;DR. There is no such thing. Same with tooling.
This is an open publication and should be considered as is. The intention was to come up with a better architectural design than REST, reusing existing Internet architecture. And that was the real challenge. Because REST and HTTP have been built almost by the same person. Bending existing Internet architecture to fit another architectural style for networked services is extremely difficult, but apparently not impossible.
GraphQL for instance, uses HTTP just for the transport layer. That's a big assumption to make there, anyone can build very flexible stuff if you are about to re-design everything HTTP gives on top of HTTP.
Another note is the reason that it takes so much time to get to the actual model (section 9) is to make sure the reader understands what is REST and where REST fails. And I haven't really seen any other document/publication explaining REST so extensively. So for those who are complaining that none gives a definition of REST, then go through section 1-6 and you should have it.
Last but not least, Introspected REST is compatible with existing REST architecture, it just makes it more robust and flexible. So for the tiny hello world example, it doesn't really make any difference other than exposing some meta data through the OPTIONS endpoint, like the (JSON) schema and the linking. But for complex APIs it should give huge advantages compared to REST.
And again: this is an open publication. From that to actual implementation there are many steps needed to be taken (for starters defining the necessary microtypes).
(As a personal aside: The difference between this spec and GraphQL is relatively minor, they seem equally complex in implementation details (e.g. correctly implementing a graphql server/resolvers is no cakewalk; and correctly implementing either in a less-programming-time way would require a large amount of meta-programming; something that this spec doesn't necessarily solve, or even seem to hint at, yet uses as an argument for it), the only real improvement is that this one is a layer lower (theoretically one less layer of abstraction/indirection improves performance and simplicity) and is not owned by Facebook).
If you take RFCs as an example, many start with a simplified description or problem statement before then proceeding to get into the details.
Of course there are a common definition for data and metadata, trying to define a common standard.
It's funny how in the end this will end into reinvent a thing like protobuf, but in JSON, much more verbose, and that can't be read by a human anyway.
GraphQL at least do all this while being human-friendly and allowing to define whats needed 'by hand' or by a machine. (But i also dont think this is a great thing to use if the communication is internal and M2M anyway, but its a great solution to serve some api to a bigger crowd of heterogeneous clients)
Some guy tries to make a case regarding web API design by being both overly pedantic and opinionated on what REST is and how everyone is doing it wrond, proceeds to assert that REST done according to the author's opinion is also wrong, and from that point on (which drags through a dozen sections to make) the author presents "a manifesto" which is the author's opinion on how web APIs should be designed and produces a convoluted definition of a strategy that solves nothing but increases complexity.
Some assertions are bafling at best, such as claiming that JSON is somehow not a media type but a message type, which is just wrong. The silliness continues in other baseless assertions such as asserting that developers are not aware that document types such as JSON are used to define JSON-based document formats, or that "Creating a new Media Type for our API is generally considered bad practice", which is just plain wrong, or for some reason conflating the thery part of a URL with the media type which is an assertion that raises some questions.
That said , even if the arguments in this spec are solid the entire industry are sold itself to GraphQL.
GraphQL has won and it won't change.
Which industry? I presume you don't mean software development which has largely ignored graphQL? BTW I speak as an early adopter who has used graphQL in production.
2012: REST has won and it won't change
2018: GraphQL has won and it won't change
2023: ...
Perfect.
Maybe 2023: gRPC has won and it won't change