REST vs SOAP

The two styles

REST (Representational State Transfer)

• Modern, dominant (JSON APIs — most web APIs)
• HTTP verbs directly: GET, POST, PUT, PATCH, DELETE
• Resource URLs: GET /users/123
• Stateless — each request carries everything
• JSON data (lightweight, readable)
• Cacheable, flexible

SOAP (Simple Object Access Protocol)

• Older, enterprise-heavy (banking, telecom, gov)
• Not verb-based — everything wrapped in XML envelope
• Own protocol rules (WS-Security, WS-ReliableMessaging)
• XML only
• Strict contract via WSDL
• Heavy: more overhead, slower

Comparison

	REST	SOAP
Mental model	Order at a counter: GET me X, POST new Y	Legal contract between banks: formal envelope
Format	JSON	XML only
Protocol	HTTP verbs	Any (HTTP/SMTP/JMS) + envelope
State	Stateless	Can be stateful (WS-*)
Contract	Loose (OpenAPI optional)	Strict (WSDL required)
Security	HTTPS + OAuth/JWT	WS-Security (built-in, heavy)
Performance	Light, fast	Heavy (XML parsing)
Use	Public APIs, mobile, web	Enterprise, legacy, regulated
Tools	Postman, curl, any HTTP client	SoapUI (dedicated)

Attack surfaces (CAPIJ angle)

REST:

• BOLA (change IDs) — API1
• Mass assignment / property-level authz — API3
• Injection via JSON bodies
• Missing rate limits — API4

SOAP:

• XXE (XML External Entity) — <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> reads local files
• WSDL scraping — the .wsdl file lists every operation = your API map
• SOAPAction header spoofing — invoke unauthorized operations
• XML bomb / billion laughs (DoS)

Talking to each

# REST
curl -X GET https://api.example.com/users/123 -H "Authorization: Bearer eyJ..."

# SOAP
curl -X POST https://bank.example.com/ws \
  -H "Content-Type: text/xml" \
  -H "SOAPAction: GetBalance" \
  -d '<?xml version="1.0"?>
      <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
        <soap:Body>
          <GetBalance xmlns="urn:bank"><acct>123</acct></GetBalance>
        </soap:Body>
      </soap:Envelope>'

Memory

REST = JSON + HTTP verbs + stateless (modern web)
SOAP = XML envelope + WSDL contract (legacy enterprise)

Related

• [[api-hacking/index]]