9 REST APIs: Payload and Resource Design
Start with the story: A REST API is the map a device, app, or service uses to talk about real things: thermostats, readings, commands, firmware, and alerts. Good design makes those things obvious in the URL, uses HTTP verbs consistently, and returns errors that tell the next engineer what actually happened.
9.1 Start With the Decision
A small sensor can spend more energy on JSON bytes than on its reading. Resource names and payload format must match the fleet constraint.
9.2 Route Overview
This is part 1 of 2. Continue with REST APIs: Versioning and Fleet Operations.
9.3 Part Objectives
- Apply REST constraints to IoT resources and methods.
- Calculate JSON and CBOR payload savings.
- In 60 Seconds
- Key Concepts
- For Beginners: REST API Patterns for IoT
- Following the Recipe Book
- Prerequisites
- How This Chapter Fits
- IoT API Design Best Practices
- Understanding REST Constraints
- Payload Format Selection
- Tradeoff: JSON vs Binary Payload Formats (CBOR/Protobuf)
- Putting Numbers to It: JSON vs CBOR Payload Savings
- Checkpoint: Payload Evidence
9.4 Learning Objectives
By the end of this chapter, you will be able to:
- Distinguish RESTful vs Message-Based Patterns: Analyze the trade-offs between request-response (REST/CoAP) and publish-subscribe (MQTT) architectures to select the appropriate pattern for a given IoT use case
- Design Topic and URI Naming Conventions: Construct consistent MQTT topic hierarchies and CoAP URI structures that scale to thousands of devices in multi-tenant deployments
- Evaluate and Select Payload Formats: Compare JSON, CBOR, and Protocol Buffers across size, parsing overhead, and tooling constraints; justify format choices for constrained vs. cloud endpoints
- Implement API Versioning Strategies: Apply URI path, header, and query-parameter versioning techniques; assess the cost of breaking changes against maintaining parallel API versions
- Configure Rate Limiting and Throttling: Design token-bucket rate-limiting policies to protect infrastructure from device misbehavior and calculate the financial impact of unconstrained traffic
- Apply IoT API Security Principles: Implement TLS/DTLS, per-request authentication tokens, and credential rotation; diagnose common authentication vulnerabilities in deployed IoT systems
Read these points as one connected sequence: start with Core Concept: Fundamental principle underlying REST API Design Patterns — understanding this enables all downstream design decisions; then Key Metric: Primary quantitative measure for evaluating REST API Design Patterns performance in real deployments; then Trade-off: Central tension in REST API Design Patterns design — optimizing one parameter typically degrades another; then Protocol/Algorithm: Standard approach or algorithm most commonly used in REST API Design Patterns implementations; then Deployment Consideration: Practical factor that must be addressed when deploying REST API Design Patterns in production; then Common Pattern: Recurring design pattern in REST API Design Patterns that solves the most frequent implementation challenges; and finish with Performance Benchmark: Reference values for REST API Design Patterns performance metrics that indicate healthy vs. problematic operation.
- Core Concept: Fundamental principle underlying REST API Design Patterns — understanding this enables all downstream design decisions
- Key Metric: Primary quantitative measure for evaluating REST API Design Patterns performance in real deployments
- Trade-off: Central tension in REST API Design Patterns design — optimizing one parameter typically degrades another
- Protocol/Algorithm: Standard approach or algorithm most commonly used in REST API Design Patterns implementations
- Deployment Consideration: Practical factor that must be addressed when deploying REST API Design Patterns in production
- Common Pattern: Recurring design pattern in REST API Design Patterns that solves the most frequent implementation challenges
- Performance Benchmark: Reference values for REST API Design Patterns performance metrics that indicate healthy vs. problematic operation
9.5 For Beginners: REST API Patterns for IoT
REST API design patterns are proven templates for building interfaces that devices and applications use to communicate. Think of patterns as recipes — rather than inventing a new way to handle pagination, authentication, or error responses every time, you follow a well-tested approach that developers already know and expect.
“Every time I build an API, I start from scratch,” sighed Temperature Terry. “There must be a better way.”
the microcontroller handed him a pattern book. “There is! Design patterns are like cooking recipes that smart engineers already figured out. For example, the pagination pattern: when you have 10,000 temperature readings, don’t dump them all at once. Send 50 at a time with a ‘next page’ link. It’s like reading a book chapter by chapter instead of swallowing the whole thing.”
“My favorite is the error response pattern,” said the LED. “Instead of just saying ‘error’, you return a structured message with a code, a human-readable description, and a hint about what to fix. Like the difference between a teacher saying ‘wrong’ versus ‘wrong — try converting to Celsius first.’”
the battery added: “And the rate limiting pattern saves my energy. The API says ‘you can ask me 100 times per minute, but no more.’ This stops badly written apps from hammering a sensor with thousands of requests and draining its battery. Patterns protect both the client and the server!”
9.6 Prerequisites
Before diving into this chapter, you should be familiar with:
- Introduction and Why Lightweight Protocols Matter: Understanding HTTP pitfalls in IoT
- Protocol Overview and Comparison: Technical comparison of HTTP, MQTT, and CoAP
- HTTP Basics: Request methods (GET, POST, PUT, DELETE), status codes, headers
9.7 How This Chapter Fits
REST API Design Series Navigation:
Read these points as one connected sequence: start with Introduction and Why Lightweight Protocols Matter; then Protocol Overview and Comparison; then REST API Design for IoT (Index); then Design Patterns (this chapter); then REST API Practice; then Real-Time Protocol Workflows; and finish with Protocol Selection Worked Examples.
- Introduction and Why Lightweight Protocols Matter
- Protocol Overview and Comparison
- REST API Design for IoT (Index)
- Design Patterns (this chapter)
- REST API Practice
- Real-Time Protocol Workflows
- Protocol Selection Worked Examples
This chapter focuses on practical REST API design patterns for IoT systems.
9.8 IoT API Design Best Practices
Understanding protocol theory is essential, but practical API design determines whether your IoT system is maintainable, scalable, and developer-friendly. This section provides actionable guidance for designing IoT APIs using the protocols covered in this chapter.
Core Concept: REST (Representational State Transfer) defines six architectural constraints - client-server separation, statelessness, cacheability, uniform interface, layered system, and optional code-on-demand - that enable scalable, reliable web services.
Why It Matters: For IoT APIs, the statelessness constraint is critical: each request must contain all information needed to process it, with no server-side session state. This enables horizontal scaling (any server can handle any request), simplifies load balancing across regions, and allows devices to reconnect to different servers without losing context after network disruptions.
Key Takeaway: Design IoT REST APIs around resources (nouns like /devices/, /sensors/, /readings/) not actions (verbs like /getTemperature), and include authentication tokens in every request rather than relying on server sessions - this matches IoT reality where devices may connect through different gateways over time.
9.8.1 RESTful vs Message-Based Patterns
The choice between REST (HTTP/CoAP) and message-based (MQTT) architectures fundamentally shapes your API design:
| Aspect | REST (HTTP/CoAP) | Message-Based (MQTT) |
|---|---|---|
| Pattern | Request-Response | Publish-Subscribe |
| State | Stateless | Connection-based |
| Discovery | URI paths | Topic hierarchy |
| Scalability | Horizontal (add servers) | Vertical (broker capacity) |
| Best For | CRUD operations, device control | Event streams, telemetry |
| Client Complexity | Simple (standard HTTP libs) | Moderate (manage subscriptions) |
Design principle: Use REST for commands and queries (“What is the temperature?”), use pub-sub for events and updates (“Temperature changed!”).
9.8.2 Topic and URI Naming Conventions
Consistent naming prevents confusion in systems with thousands of devices:
9.8.2.1 MQTT Topic Hierarchy
# Structure:
# {organization}/{location}/{building}/{floor}
# /{device_type}/{device_id}/{data_type}
# Examples:
acme/hq/bldg1/floor3/hvac/unit42/temperature
acme/factory/line2/sensor/pressure01/value
acme/warehouse/zone-a/motion/detector03/event
# Wildcards for subscriptions:
acme/hq/+/+/hvac/+/temperature # All HVAC temps in HQ
acme/+/+/+/motion/+/event # All motion events company-wide
Best practices:
Read these points as one connected sequence: start with Use lowercase, hyphens for readability; then Start with organization/tenant for multi-tenant systems; then Include location hierarchy for geographical filtering; then End with data type (temperature, status, event, command); and finish with Avoid special characters (/, +, #, $ reserved).
- Use lowercase, hyphens for readability
- Start with organization/tenant for multi-tenant systems
- Include location hierarchy for geographical filtering
- End with data type (temperature, status, event, command)
- Avoid special characters (/, +, #, $ reserved)
9.8.2.2 CoAP URI Pattern
# Structure: coap://{host}/{version}/{resource_type}/{device_id}/{subresource}
# Examples:
coap://sensors.local/v1/devices/temp42/reading
coap://actuators.local/v1/devices/valve12/status
coap://gateway.local/v1/config/network
# Query parameters for filtering:
coap://sensors.local/v1/devices/temp42/history?start=2025-01-01&limit=100
Best practices:
Read these points as one connected sequence: start with Always version your API (/v1/, /v2/) to allow migration; then Use plural resource names (/devices/, not /device/); then Keep URIs short (remember constrained bandwidth); and finish with Use query parameters sparingly (adds overhead).
- Always version your API (
/v1/,/v2/) to allow migration - Use plural resource names (
/devices/, not/device/) - Keep URIs short (remember constrained bandwidth)
- Use query parameters sparingly (adds overhead)
9.9 Payload Format Selection
The right payload format balances human readability, efficiency, and tooling support:
| Format | Size | Human Readable | Schema Validation | Best For |
|---|---|---|---|---|
| JSON | Large (verbose) | Yes | JSON Schema | Development, debugging, web apps |
| CBOR | Small (binary) | No | CDDL | Constrained devices, low bandwidth |
| Protocol Buffers | Small (binary) | No | .proto files | High volume, multiple languages |
| MessagePack | Medium | No | None | Mixed environments |
| Plain Text | Variable | Yes | None | Simple sensors, legacy systems |
Option A: Use JSON for human-readable, easily debuggable message payloads Option B: Use binary formats (CBOR, Protocol Buffers) for compact, efficient encoding
Decision Factors:
| Factor | JSON | CBOR/Protobuf |
|---|---|---|
| Payload size | Large (50-100% overhead) | Small (10-30% of JSON) |
| Human readable | Yes (text-based) | No (requires decoder) |
| Debugging | Easy (curl, browser tools) | Requires specialized tools |
| Schema enforcement | Optional (JSON Schema) | Built-in (CDDL, .proto) |
| Parsing complexity | Moderate (string parsing) | Low (binary scanning) |
| CPU usage | Higher (text parsing) | Lower (direct decode) |
| Tooling ecosystem | Excellent (universal) | Good (growing) |
| Bandwidth cost | Higher | Lower |
Choose JSON when:
Read these points as one connected sequence: start with Development and debugging convenience is priority (prototyping phase); then Integrating with web services, REST APIs, or JavaScript clients; then Message frequency is low (hourly reports, configuration); then Devices have sufficient processing power and bandwidth (Wi-Fi gateways); and finish with Team lacks binary protocol expertise.
- Development and debugging convenience is priority (prototyping phase)
- Integrating with web services, REST APIs, or JavaScript clients
- Message frequency is low (hourly reports, configuration)
- Devices have sufficient processing power and bandwidth (Wi-Fi gateways)
- Team lacks binary protocol expertise
Choose Binary (CBOR/Protobuf) when:
Read these points as one connected sequence: start with Bandwidth is constrained or metered (cellular, satellite, LPWAN); then High message frequency makes overhead significant (10+ messages/second); then Battery life depends on minimizing transmission time; then Strict schema validation is required for data quality; and finish with Production systems where debugging tools are already in place.
- Bandwidth is constrained or metered (cellular, satellite, LPWAN)
- High message frequency makes overhead significant (10+ messages/second)
- Battery life depends on minimizing transmission time
- Strict schema validation is required for data quality
- Production systems where debugging tools are already in place
Default recommendation: JSON for development, cloud APIs, and low-frequency messages; CBOR for constrained devices and CoAP payloads; Protocol Buffers for high-volume systems with strong typing requirements
Example comparison (temperature reading):
// JSON: 43 bytes
{"device":"temp42","value":23.5,"unit":"C"}
// CBOR: ~30 bytes (binary, shown as hex; string keys retained)
A3 66 64 65 76 69 63 65 66 74 65 6D 70 34 32...
// Plain text: 4 bytes
23.5
Design recommendations:
Read these points as one connected sequence: start with Battery sensors: Use CBOR or plain text (minimize bytes over air); then Cloud APIs: Use JSON (debugging, wide tool support); then High-frequency telemetry: Protocol Buffers (efficient, versioned); and finish with Mixed systems: JSON at gateway, CBOR on constrained networks.
- Battery sensors: Use CBOR or plain text (minimize bytes over air)
- Cloud APIs: Use JSON (debugging, wide tool support)
- High-frequency telemetry: Protocol Buffers (efficient, versioned)
- Mixed systems: JSON at gateway, CBOR on constrained networks
How much bandwidth and energy can binary formats save? Let’s quantify the difference between JSON and CBOR for a typical IoT sensor payload.
Example payload: Temperature reading with metadata.
JSON representation (human-readable):
{"device":"sensor-042","temp":23.5,"unit":"C","time":1705392000}
CBOR representation (binary, using integer map keys 1-4 instead of string key names):
Bandwidth savings:
Energy impact (LoRaWAN SF7/125 kHz, simplified proportional estimate):
Actual LoRaWAN airtime depends on spreading factor, coding rate, and header overhead using the Semtech formula — it is not simply linear in byte count. As a proportional approximation illustrating relative savings:
- JSON (64 bytes): proportionally longer airtime at SF7 ≈ longer transmission
- CBOR (28 bytes): of JSON airtime
- Transmission time savings:
(For accurate airtime budgeting, use the Semtech LoRa Airtime Calculator with your specific SF, BW, and CR parameters.)
At scale (10,000 sensors, 1 message/hour for 1 year):
9.9.1 Calculation Audit
The example uses a minified UTF-8 JSON body, integer CBOR keys, and decimal gigabytes. The raw arithmetic is:
Read these points as one connected sequence: start with The JSON string {"device":"sensor-042","temp":23.5,"unit":"C","time":1705392000} is 64 bytes; then The CBOR estimate is 28 bytes, so the byte reduction is 64 - 28 = 36 bytes; then The percentage reduction is 36 / 64 = 0.5625, or 56.25% smaller; then Hourly reporting for 10,000 sensors gives 10,000 x 24 x 365 = 87,600,000 messages per year; then JSON traffic is 87,600,000 x 64 = 5,606,400,000 bytes, or 5.6064 GB using 1 GB = 1,000,000,000 bytes; then CBOR traffic is 87,600,000 x 28 = 2,452,800,000 bytes, or 2.4528 GB; and finish with The annual saving is 5.6064 - 2.4528 = 3.1536 GB, which rounds to the 3.15 GB/year figure above.
- The JSON string
{"device":"sensor-042","temp":23.5,"unit":"C","time":1705392000}is64bytes. - The CBOR estimate is
28bytes, so the byte reduction is64 - 28 = 36bytes. - The percentage reduction is
36 / 64 = 0.5625, or56.25%smaller. - Hourly reporting for
10,000sensors gives10,000 x 24 x 365 = 87,600,000messages per year. - JSON traffic is
87,600,000 x 64 = 5,606,400,000bytes, or5.6064 GBusing1 GB = 1,000,000,000bytes. - CBOR traffic is
87,600,000 x 28 = 2,452,800,000bytes, or2.4528 GB. - The annual saving is
5.6064 - 2.4528 = 3.1536 GB, which rounds to the3.15 GB/yearfigure above.
For a real battery budget, combine this byte-count reduction with the radio’s airtime formula, retries, receive windows, wake cost, and sleep current. The 56% figure is a payload-size reduction; it only becomes an energy reduction when transmit airtime dominates the device budget.
Key insight: For battery-powered devices, every byte transmitted can shorten battery life. CBOR’s 56% payload reduction can approach a similar airtime saving for transmission-dominated budgets, but the measured power model decides the final battery result. The tradeoff: debugging requires binary decoders instead of simple text tools.
9.9.2 Interactive: Payload Format Size Comparison Calculator
Estimate serialized payload sizes for different formats based on the number and types of fields in your IoT message.
Checkpoint: Payload Evidence
The payload section gives you the evidence a design review should keep:
- You now know that the example JSON body is
64bytes and the compact CBOR estimate is28bytes. - You now know that
64 - 28 = 36bytes, or56.25%smaller, is a payload-size claim first; it becomes an energy claim only when transmit airtime dominates the device budget. - You now know why the chapter recommends JSON for cloud APIs and debugging, CBOR for constrained CoAP payloads, and Protocol Buffers for high-volume systems with strong typing.
9.10 Continue to the Next Part
Carry this evidence into REST APIs: Versioning and Fleet Operations, which begins with API Versioning Strategies.
