REST and GraphQL are two API styles with opposite trade-offs — the answer is knowing when each fits.

REST

Resources exposed as multiple endpoints, each returning a fixed shape:

GET /users/1
GET /users/1/posts
GET /posts/5/comments

• Over-fetching — the endpoint returns fields you don't need.
• Under-fetching — you need 3 endpoints to build one screen → request waterfalls (the "N+1 endpoints" problem).
• HTTP caching is easy — each URL is cacheable by browsers, CDNs, proxies.
• Simple, ubiquitous, great tooling, stateless.

GraphQL

A single endpoint; the client sends a query describing exactly the data it wants:

query {
  user(id: 1) {
    name
    posts { title comments { text } }
  }
}

• No over/under-fetching — you get precisely the fields and depth requested, in one round-trip.
• Strongly typed schema — self-documenting, great DX, introspection.
• Caching is harder — one POST endpoint, so HTTP/CDN caching doesn't apply; you rely on a client cache (Apollo, urql, Relay) keyed by entity IDs.
• Other hard parts — rate limiting and query-cost analysis (a malicious deep query can be expensive), N+1 on the server (needs DataLoader), more upfront setup.

When to use which

• REST — simple/CRUD-shaped resources, public APIs, when HTTP caching matters, file uploads, small teams.
• GraphQL — complex, deeply nested, highly relational data; many client types (web/mobile) each needing different shapes; rapidly evolving frontends that shouldn't wait on new backend endpoints.

It's not either/or — many systems use REST for some things and GraphQL for others, and tools like tRPC offer a third path.

The framing

"REST is multiple fixed-shape endpoints — simple and HTTP-cacheable, but you over-fetch fields and under-fetch resources, causing waterfalls. GraphQL is one endpoint where the client asks for exactly the fields it needs in one round-trip — excellent for complex nested data and multiple clients — but you trade away easy HTTP caching and take on rate-limiting and server-side N+1 concerns. Choose by data shape and caching needs; they're not mutually exclusive."