In which OSI layer is the REST API paradigm?

Question

During an interview I was asked to classify the REST API paradigm between OSI Layers.

I thought it would have been between 5 and 7 layer; however, the interviewer said that it belongs only to the 5th layer because it is similar to RPC.

In my opinion, it can't be at 5 Session Layer only, because true REST API is stateless unlike session (HTTP session), so it could be placed as protocol on the 7th layer (application) because it is like HTTP (but why not in 6th as well?).

I searched online but I didn't find a clear answer (I know that some protocols are distributed ambiguously in OSI layers).

Maybe other people have a clearer opinion on this?

Placer

All the REST services I have encountered are being relayed via some type of an http server. Unless you create your own socket server and implement a restful service protocol yourself then you will be at or above whatever OSI level that http server you are running is categorized as. – Phobos

REST is just an architectural style and an API which strictly follows the REST principles is called RESTful API. Having said that, AFIK, you can write only "Application layer" APIs with REST principles(Writing APIs/protocols of remaining layers with REST doesn't make sense to me),so REST APIs sit at Application layer. – Cohlier

An API is not a protocol. REST is not a protocol. HTTP is an application layer protocol. osi is defunct and irrelevant. Unclear what you're asking. – Figured

Answer 1

REST architecture is stateless in a sense that the server does not store the state of the client, but state of the objects are transferred back and forth. After all, REST stands for Representational State Transfer. So, I'd think REST belongs to Layer 5 - Session Layer, which is commonly described as the layer where continuous exchange of information in the form of multiple back-and-forth transmissions between two nodes.

It's hard to see how REST API could belong to the Layer 6 or Layer 7 of the OSI Model. The Presentation layer provides for negotiation of the form of representation or syntax of the data that will be transferred. Usually mechanisms like character encoding (UTF, ASCII), data encryption and decryption are part of presentation layer. Application layer provides application specific services like FTP, HTTP, Telnet that support end user processes.

Molar

Please share more details. How does REST work in your configuration of layers if it was not build upon HTTP? – Epirus

Answer 2

REST is not a protocol for two systems to communicate. REST is an architecture style. It is mostly atop HTTP, the application layer.

Sacha

What if a protocol is based on REST? Like SRU. We should split application layer into different sublayers? – Devitalize

@PabloBianchi I don't think the answer is creating more layers. The TCP/IP model is only 4 layers and makes much more sense in Internet concepts. Everything above the OS (Network and Transport layers) is simply "Application". What the application chooses to do with the data should be out of scope for an "interconnection model". This holds true for everything from Internet to generic copper/RF/IR connected microcontrollers. – Coquillage

Answer 3

REST is an API (Application Programming Interface) in the Application Layer. Don't let the "Session" title of Layer 5 confuse you. REST is squarely Layer 7. What is below the Application? The Operating System. Does the OS care about REST? Let's look at the response headers from this very page.

$ curl -svo /dev/null https://mcmap.net/q/640545/-in-which-osi-layer-is-the-rest-api-paradigm 2>&1 | grep '^[<>]'
> GET /q/29264855 HTTP/2
> Host: stackoverflow.com
> User-Agent: curl/7.64.1
> Accept: */*
>
< HTTP/2 200
< cache-control: private
< content-type: text/html; charset=utf-8
< last-modified: Sat, 05 Dec 2020 07:07:50 GMT
< set-cookie: prov=9bbe6161-8a11-c618-c487-ff38f7c65f3b; domain=.stackoverflow.com; expires=Fri, 01-Jan-2055 00:00:00 GMT; path=/; HttpOnly
<

The qualities which make this REST lies entirely in the HTTP headers you see here. Does the operating system do anything with any of that other than deliver it to the "client application"? No it doesn't.

Coquillage

Illegible. Don't post pictures of text here. REST is an API, not a protocol. The only protocol here is HTTP. – Figured

@MarquisofLorne I replaced the browser screenshot with curl output. – Coquillage

This is the right answer. REST is layer 7. – Damper