Protocols are the agreed-upon rules that let machines communicate: what to send, in what order, and what to do when things go wrong. Every layer of the stack (link, network, transport, application) has its own protocol set, and production debugging often means knowing which layer broke the contract. Example: an HTTP 502 can mean the upstream is down, or it can mean a TLS version mismatch between proxy and origin that never shows up in application logs.

Layer in this vaultWhat it providesExamples
ApplicationMessage meaning, resources, operations, authentication hooks, and errorsDNS, HTTP, SMTP, SSH, WebSockets, GraphQL, gRPC
Security between application and transportPeer authentication, confidentiality, and integrityHTTPS is HTTP protected by TLS; it is not a separate transport
TransportEnd-to-end byte or datagram delivery, ordering, congestion, and portsTCP, UDP, and QUIC; HTTP/3 runs over QUIC, which is built on UDP
NetworkAddressing and routing between networksIP

When an API times out, locate the boundary before changing application code: name resolution can fail in DNS, connection establishment in TCP or QUIC, peer authentication in TLS or SSH, and message semantics in HTTP or the API style above it.

For registered service ports and what they usually imply, see Ports.

Choosing an API Style

Several of these protocols are interchangeable styles for client–server APIs, so the real decision is between them. DNS and SMTP are single-purpose protocols rather than API styles. HTTP and HTTP 2 provide the HTTP application-protocol substrate used by REST, GraphQL, and gRPC; WebSocket begins with an HTTP opening handshake and then switches to its own bidirectional framing protocol.

StyleInteractionContract and payloadBrowser/cache boundaryOperational coupling
RESTRequest/response around resourcesServer-owned HTTP contract; usually JSON, but media type is negotiableNative browser reach; HTTP methods and URLs give intermediaries useful cache keysLoose when resources and compatibility rules are stable; clients still coordinate representation changes
GraphQLClient selects a graph-shaped response; subscriptions add server streamsShared typed schema plus client-owned operation documents; commonly JSON over HTTPNative HTTP, but arbitrary POST /graphql calls need persisted IDs or custom cache keysSchema, cost, authorization, and resolver fan-out require a governed execution platform
RPC / gRPCUnary calls or typed streams around operationsCode-generated service contract; gRPC normally uses Protocol Buffers and HTTP/2 framingDirect browser use needs gRPC-Web or another bridge; HTTP caches do not understand method meaningTight schema/toolchain coupling is acceptable when both ends release under engineering control
WebSocketsLong-lived, bidirectional messagesApplication-defined messages inside WebSocket framesBrowser-native, but not normal HTTP response cachingEvery client consumes connection state; reconnect, resume, backpressure, and fan-out are application concerns
WebhookAsynchronous server-to-server callbackProvider-owned HTTP event contractReceiver endpoint rather than browser API; retries need event IDs and signature verificationProvider controls delivery schedule; consumer must tolerate duplicates and out-of-order arrival

Default to REST for an external resource API with broad reach and useful HTTP caching. Choose GraphQL when independently evolving clients genuinely need selectable graph projections and the organization can govern one schema. Choose gRPC for controlled service-to-service contracts and streaming. Choose WebSockets only for low-latency bidirectional traffic; use webhooks when the receiver can expose an HTTP endpoint and eventual delivery is enough.

References

14 items under this folder.