Choosing REST vs. SOAP is a tough step in the API process if you’re a beginner. SOAP and REST are different approaches to data transmission for APIs.
Do you want to connect your app to Instagram to repost images using specific hashtags, or to Facebook so it can automatically create posts? Or maybe you want to embed YouTube videos on your website? You can do all of these things and more with application programming interfaces (APIs).
APIs, like the Instagram API, Facebook API, and YouTube API, provide a secure and standardized way for different software to "talk" to each other. Meaning, an application can extract functionality or data from another piece of software and use it to enhance its own functionality or UX.
But how do applications make these requests, process them, and answer them effectively? That depends on how you build the API. Let’s go over the two most common methods below, SOAP and REST. Then, we'll compare the differences in detail.
SOAP, which stands for Simple Object Access Protocol, is a highly strict and secure way to build APIs that encodes data in XML.
REST, which stands for Representational State Transfer, is a simpler and more flexible method for building APIs. REST APIs can transfer data in a variety of formats, including XML, as well as plain text, HTML, and JSON.
Check out this post for more on REST APIs.
REST and SOAP are two different ways to connect applications with server-side data. Both of the API formats use data that both humans and machines can read, and both often use HTTP protocols. But there are many differences between the two.
The graphic below outlines some REST vs. SOAP differences.
Now that we have a high-level overview of the differences between SOAP and REST, let’s take a closer look at how they compare in terms of services, security, and examples.
To compare SOAP and REST APIs, we first have to understand what each type of API does exactly.
SOAP is a standard communication protocol system that uses XML technologies to define an extensive messaging framework that allows structured information to be exchanged in a decentralized, distributed environment. In other words, SOAP allows applications running on different operating systems to communicate using different technologies and programming languages.
A client can use SOAP APIs to create, retrieve, update, or delete records, such as passwords, accounts, leads, and custom objects, from a server.
REST, on the other hand, is an architectural style, not a protocol. As stated above, it stands for Representational State Transfer. That means, when a client requests a resource using a REST API, the server transfers back the current state of the resource in a standardized representation. In other words, REST APIs receive requests for a resource and return all relevant information about the resource in a format that clients can easily interpret.
In addition to requesting resources, clients can use REST APIs to modify and even add new items on a server using HTTP methods.
For a more in-depth description, read REST APIs: How They Work and What You Need to Know.
Now that we have a better understanding of what SOAP and REST APIs do, let’s compare their security measures and protocols.
Since SOAP is a messaging protocol, securing SOAP APIs is primarily focused on preventing unauthorized access to the messages (and users’ information contained within those messages) received by and sent from SOAP APIs. The main defense against unauthorized access is Web Standards (WS) Security, a set of principles that regulate the confidentiality and authentication procedures for SOAP messaging. WS Security-compliant measures include passwords, XML encryption, and security tokens, among other mechanisms.
WS Security goes beyond traditional web security mechanisms, such as HTTPS, which only secures messages during the transport between the client that made the request and the server or web service that has the data being requested. WS Security, on the other hand, secures messages beyond the HTTPS connection and sometimes even beyond the transport layer.
How does it do this, exactly?
A SOAP message either contains the information needed to secure it, or contains information about where to get the information needed to secure it. A SOAP message also contains information relevant to the protocols and procedures for processing the specified message-level security in its header. That means when a web service endpoint receives a SOAP message, it verifies the security information in the header to make sure it has not been tampered with. That’s why SOAP is said to have "message-level security."
SOAP supports WS specifications like:
Because of this, SOAP APIs are ideal for internal data transfers and other sensitive tasks — but unnecessary for using a public web service that’s freely available to everyone, like retrieving weather data. We’ll talk more about when to use REST vs. SOAP APIs later in the post.
REST APIs only support traditional web security mechanisms, such as HTTPS. That means when an application sends and retrieves a message from a REST API using HTTPS, the message is secured only for the HTTPS connection. Meaning, the message is secured only during the transport between the client and the service. That’s fine for public web services, but may not be enough for more sensitive data transfers.
Since REST APIs don’t have the built-in security capabilities or extensions that SOAP has, their security depends on the design of the APIs themselves. REST APIs can be designed with certain security mechanisms that ensure that only authenticated and authorized users can access them. Common REST API authentication methods are HTTP basic authentication, JSON web tokens, OAuth, and API keys.
REST APIs should also have detailed specifications and reject any requests that don’t have the correct declarations in their HTTP headers, for example, or otherwise follow their specifications. This will help protect the underlying web application from malformed and malicious inputs, even after the client has gained access.
Let’s compare some examples of requests and responses to and from a SOAP API and a REST API. The examples below are based on the QAComplete SOAP API and REST API, respectively. QAComplete is a comprehensive software test management tool by SmartBear.
QAComplete SOAP requests are HTTP POST requests made to the web service endpoint URL. The client and server exchange data in the XML format in the body of HTTP requests and responses.
This SOAP API only accepts HTTP POST requests but it also supports several common operations for all item types, including Add, Delete, Load, LoadByCriteria, and Update. You’ll see these operations instead of the HTTP verbs GET, PUT, PATCH, and DELETE.
The sample code below is requesting to get a defect by its ID in a project in QAComplete using the SOAP API. The code snippet is written in XML and uses the Bugs_Load operation:
The response will contain an HTTP status code and a Bug object containing information on the needed defect. It will be written in XML. In the example below, there’s an HTTP status code 200 to show the request was successful as well as info on the defect in XML:
Notice that this SOAP message contains an envelope, header, and body element, all of which are required.
REST requests are HTTP requests made to the the endpoint URL of QAComplete REST API, which has the following format: http(s)://{your-server}/rest-api/service/api/{version}/{resource}. This API uses the HTTP methods GET, POST, PUT, PATCH, and DELETE.
The sample code below is requesting to get a defect by its ID in a project in QAComplete using the QAComplete REST API. The code snippet is written in JSON and uses the HTTP method, GET:
The server will return an HTTP status code and information on the defect. In the example below, there’s an HTTP status code 200 to show the request was successful as well as a JSON object with info on the defect:
Notice that this response is not as long as the response given by the SOAP API. Since REST APIs typically send back responses with less data and in the JSON format, they require less bandwidth to use than SOAP APIs.
For specific use cases of when to use SOAP vs REST, keep reading.
SOAP allows data to be transferred in a decentralized, distributed environment. It also has lots of web security mechanisms. These qualities make it ideal for enterprise solutions.
Unlike calls to REST APIs, calls to SOAP APIs are stateful. This means the server stores information about the client and uses that information over a series of requests or chain of operations.
While this requires more server resources and bandwidth, it’s important if performing repetitive or chained tasks, like bank transfers.
SOAP is independent of an underlying transport protocol, so you don’t have to use HTTP. Instead, you could use SMTP (Simple Mail Transfer Protocol), JMS (Java Messaging Service), or another transport protocol, depending on your application.
Many consider REST APIs easier to use and adopt than SOAP APIs. which makes them ideal for creating public web services. REST also lacks some built-in security features that SOAP has — but they aren’t necessary when working with public data and services.
All calls to a REST API must be stateless. This means that every interaction is independent so each request and response provides all the information required to complete that interaction. Since the server interprets every request as brand new, the server does not store information on past requests.
This greatly reduces the amount of server memory needed. It improves performance since the server is not required to take additional action or retrieve past data when fulfilling a request.
Because REST is stateless, data can be cached, which also saves server resources and bandwidth.
Finally, REST APIs can use different data formats, like JSON, which is lighter than XML. This makes them faster and more efficient than most SOAP APIs.
Because REST is lightweight, efficient, stateless, and cacheable, it’s ideal for building mobile applications.
There’s no golden rule for building APIs. Deciding between SOAP vs. REST when building APIs depends on a variety of factors, including what programming language you use and how much time you have to build it.
Editor's note: This post was originally published in September 2021 and has been updated for comprehensiveness.