If your team runs more than one API, you have probably had the argument already: REST for the public surface, gRPC between services, GraphQL for the frontend, or one style everywhere. Most API design books never settle it, because they were written about one style and treat the other two as a footnote. The best API design books help you make that call. Then they carry you through naming, versioning, pagination, gateways and security.
Two 2025 titles changed the shelf. O’Reilly’s Learning API Styles gives REST, GraphQL, gRPC, webhooks, WebSocket and messaging a chapter each. Arnaud Lauret’s The Design of Web APIs came back as a 536-page second edition, with gRPC and GraphQL material added to its OpenAPI core. We checked every edition, page count and listing below against the publishers and Amazon’s own catalog in November 2026, so the dates and price bands reflect what you can order today.
The short list by API style
Pick by the decision you are facing this quarter, not by which book has the most stars. A team choosing its first internal RPC framework needs a different book from a team whose public REST API keeps breaking clients on every release:
- Best overall, REST vs gRPC vs GraphQL: Learning API Styles, the newest book that compares every major style side by side.
- Best for REST API design: The Design of Web APIs, Second Edition, built around OpenAPI and 70+ exercises.
- Best API design patterns book: API Design Patterns by JJ Geewax, for resource-oriented APIs that have to last.
- Best for gRPC: gRPC: Up and Running, still the clearest single gRPC book despite its 2020 date.
- Best for GraphQL: GraphQL in Action, a full schema-to-client build in Node.js.
- Best for platform and architecture teams: Mastering API Architecture, which covers gateways, service mesh and API testing.
The table puts the eight picks next to each other on the things that change the buying decision. Read the “Published” column before anything else, because API books age through their examples long before their principles go stale:
| Book | API styles covered | Published | Pages | Best for |
|---|---|---|---|---|
| Learning API Styles | REST, GraphQL, gRPC, webhooks, WebSocket, messaging | 2025 | 412 | Choosing a style |
| The Design of Web APIs, 2nd Ed | REST with OpenAPI, notes on gRPC and GraphQL | 2025 | 536 | Designing REST contracts |
| API Design Patterns | Resource-oriented (REST and RPC) | 2021 | 480 | Long-lived public APIs |
| Patterns for API Design | Technology-neutral, 44 patterns | 2022 | 544 | Architects and reviewers |
| Mastering API Architecture | REST, gRPC, brief GraphQL | 2022 | 286 | Gateways, mesh, testing |
| gRPC: Up and Running | gRPC (Go and Java) | 2020 | 202 | Service-to-service RPC |
| GraphQL in Action | GraphQL (Node.js) | 2021 | 384 | Building a GraphQL server |
| Secure APIs | Security across APIs, Python examples | 2025 | 376 | OWASP API Top 10 work |
Two things stand out in that table. Only three of the eight were published after 2023. The two style-specific books (gRPC and GraphQL) are the oldest, so treat their code as illustration and take the current API from the project docs. The page counts also mislead: the 286-page Mastering API Architecture covers more operational ground than books nearly twice its length, because it skips the design basics the others spend their first hundred pages on.
How we chose these API books
We started from Amazon’s catalog for Manning, O’Reilly, Addison-Wesley and No Starch, then cut anything that only teaches one framework. A FastAPI or ASP.NET Core book is a framework book, not an API design book. Each survivor had to teach a decision you will face on a real API: which style, how resources are named, how the contract evolves, how it is secured and operated. We read each book’s table of contents or publisher chapter outline and the publisher’s description, and checked edition, page count, binding and stock through Amazon’s product data. Short-run self-published titles with no table of contents we could verify were left out, even when they were newer than our picks.
None of this is a substitute for reading a chapter yourself, and Manning’s liveBook previews or an O’Reilly trial let you do that before paying. If a book’s code style grates on page five, it will grate on page three hundred.
1. Learning API Styles
This is the book we’d hand a team before the REST versus gRPC versus GraphQL meeting, because it is the only 2025 title that treats them as equals. Lukasz Dynowski and Marcin Dulak wrote it for O’Reilly in 2025. Its 412 pages run from API concepts and network basics to a chapter each on REST, GraphQL, web feeds, gRPC, webhooks, WebSocket and messaging.
The chapter that earns its place early is the one on API design patterns. Naming, versioning, pagination, long-running operations, rate limiting, caching and the OWASP API Security Top 10 are applied across styles rather than to one. In practice this means the cross-cutting decisions sit in one chapter, ahead of the per-style chapters that apply them. The cost of covering eleven topics in one volume is depth. One chapter on gRPC will not teach you streaming deadlines or interceptors well enough to run them in production, so pair it with pick 6 once you have chosen.
- Read it for: picking a style per API with the costs of each laid out next to the others.
- Pass on it when: your style is already decided and you need depth in one of them.
- Price: usually $45 to $70 in paperback; check the current price on Amazon.
2. The Design of Web APIs, Second Edition
Arnaud Lauret’s book is the best place to learn REST API design as a discipline rather than as HTTP trivia. The second edition from Manning grew to 536 pages in 2025. It adds what the 2019 first edition lacked: automated, standardized design decisions across teams, OpenAPI with JSON Schema throughout, and notes on where gRPC and GraphQL fit. Lauret works at Postman, and it shows in how much of the book is about the contract as a reviewable artifact.
Buy the second edition and not the first, which Amazon still lists in stock. When we checked, Amazon’s own listing for the second-edition paperback showed it as unavailable. The link above goes to Manning instead, which sells the print book, the ebook and a bundle of both directly. The 70+ exercises are the reason to buy it over a blog series, because they make you write and critique a spec instead of nodding along. Its OpenAPI material predates OpenAPI 3.2 (September 2025), so check the spec for the 3.2 changes.
- Read it for: designing REST contracts in OpenAPI that other teams can review before code exists.
- Pass on it when: most of your traffic is service-to-service RPC; it stays REST-first.
- Price: about $60 list for print plus ebook at Manning.
3. API Design Patterns
JJ Geewax’s 480-page Manning book is about the decisions that hurt two years after launch. It covers how resources are laid out and named, which data types and standard methods they get, partial updates with field masks, request validation, and operations across many resources. Manning says it collects patterns from the API design community and the experts at Google, and anyone who has read Google’s public API guidance will recognize the resource-oriented model. Examples use a TypeScript-like syntax, but nothing in the book depends on the language.
This is the API design patterns book for teams shipping a public or partner API that cannot break clients. We’d reach for it the week someone proposes a fourth way to paginate. Each pattern gets a name, a motivation and its trade-offs, so a design review becomes a reference check instead of a debate. Its 2021 date matters less here than for any other pick, since resource modelling has not changed, but it says little about GraphQL or event-driven APIs.
- Read it for: a shared vocabulary for resource design, versioning and pagination reviews.
- Pass on it when: you want GraphQL schema guidance or an introduction to HTTP.
- Price: around $60 in paperback; check the current price on Amazon.
4. Patterns for API Design
Five authors (Olaf Zimmermann, Mirko Stocker, Daniel Lübke, Uwe Zdun and Cesare Pautasso) turned years of research into a catalog of 44 patterns, published by Addison-Wesley in late 2022 at 544 pages. Geewax works at the level of a resource. This book works at the level of a message: what a request and response carry, how endpoints split responsibility, and how quality and evolution are managed. It walks 29 design decisions through a running case study, Lakeside Mutual, so each pattern is tied to a reason to choose it.
It is deliberately technology-neutral, which is both its value and its limit. An architect reviewing REST, gRPC and messaging teams gets one vocabulary for all of them. A developer who wants a working endpoint by Friday will find it slow going. Before you buy, browse the free companion site at api-patterns.org, which publishes the pattern catalog and a cheat sheet. If the site’s pattern summaries already answer your questions, the book adds the decision narratives around them.
- Read it for: reviewing many teams’ APIs against one catalog, whatever their protocol.
- Pass on it when: you want code; it is a catalog, not a tutorial.
- Price: usually $50 to $55; check the current price on Amazon, where stock has been thin.
5. Mastering API Architecture
James Gough, Daniel Bryant and Matthew Auburn wrote the book for what happens after the API is designed: running it. The O’Reilly title from late 2022 covers REST and OpenAPI, gRPC and a short GraphQL section. Most of its length goes to testing (contract, component, integration and end-to-end), API gateways, service mesh, release strategies, and security with OAuth2 and TLS. The OAuth2 material covers what an API architect needs; for the identity provider side, our OAuth and identity books go further. A conference system case study evolves through every chapter, and the decisions are recorded as architecture decision records with C4 diagrams.
Platform teams get the most from it, because the gateway versus mesh chapters answer the question every platform team argues about: where north-south traffic ends and east-west traffic begins. The product names in those chapters have moved on since 2022, so read them for the reasoning and check current gateway and mesh docs for the configuration. Our service mesh and Kubernetes networking books cover the east-west side in more depth. If your platform work goes beyond APIs, our platform engineering book picks cover the internal developer platform side.
- Read it for: gateways, service mesh, API testing and ADR-driven API decisions.
- Pass on it when: you are still learning resource and contract design; read pick 2 or 3 first.
- Price: from about $40 to its $66 list; check the current price on Amazon.
6. gRPC: Up and Running
Kasun Indrasiri and Danesh Kuruppu’s 202-page O’Reilly book is still the most direct route into gRPC. It runs from protocol buffers and service definitions through the four communication patterns, interceptors, deadlines, TLS and mutual TLS, then deployment on Docker and Kubernetes. Code samples are in Go and Java for most chapters, and the gRPC Gateway section shows how to expose the same service as REST for clients that cannot speak HTTP/2.
The book is from early 2020 and it shows in one place: observability, where it uses OpenCensus, which has since been folded into OpenTelemetry. Everything about the protocol and its patterns still holds. If you want to see what gRPC buys you in numbers before committing, our walkthrough of the same Qdrant workload over REST and gRPC is a quick, concrete comparison. Go teams who want a newer, Go-only treatment can look at Manning’s gRPC Microservices in Go (2023) instead; it trades the Java coverage for a Go-only microservices build.
- Read it for: learning gRPC streaming, deadlines and mTLS with working Go and Java code.
- Pass on it when: you need current tracing setup; take that from the OpenTelemetry docs.
- Price: often $25 or less against a $50 list; check the current price on Amazon.
7. GraphQL in Action
Samer Buna’s 384-page Manning book builds one GraphQL API from schema to client: GraphQL.js and Apollo Server on Express, PostgreSQL and MongoDB behind the resolvers, Docker Compose for the databases, then a React frontend that ends on Apollo Client. Along the way it covers queries, mutations, subscriptions and resolver caching and batching, so the server you finish with handles reads, writes and live updates rather than a read-only demo schema.
The GraphQL book shelf is thin, and this is the strongest print option we could verify, but it is from early 2021. The GraphQL specification has had two releases since, in October 2021 and September 2025. A team stitching several subgraphs together with federation will need the vendor docs as well. For a single GraphQL service in Node.js it is still the right first read; if your backend is JavaScript, our Node.js book picks fill in the runtime side.
- Read it for: building and consuming a complete GraphQL API, resolvers through client.
- Pass on it when: you run federated GraphQL or work outside JavaScript.
- Price: usually $40 to $50, shipping with a lead time; check the current price on Amazon.
8. Secure APIs
José Haro Peralta, who also wrote Manning’s Microservice APIs, published Secure APIs: Design, build, and implement in late 2025 at 376 pages. It treats security as a design input rather than a pen-test finding. Topics include the OWASP API Security Top 10, security by design, zero trust, threat modeling, automated security testing in the pipeline, and observability for threat detection. It also covers AI-driven threats and using LLMs in your own security testing.
We put it last on the list, not least in importance. Broken object-level authorization has led the OWASP API list in both of its editions, and in our reading the design books above give it a section at most, where this book makes it a design concern from the first spec. The examples are in Python, which suits teams already on FastAPI or Flask (our Python book list covers the language itself), and other teams will be translating. Manning’s description does not break coverage down by REST, GraphQL and gRPC, so expect the principles to carry across and the code to be HTTP-first. For the attacker’s view, including Black Hat GraphQL, see our web application security books.
- Read it for: designing authorization and API threat models in from the first spec.
- Pass on it when: you want protocol-specific attack walkthroughs; No Starch’s Black Hat GraphQL (2023) does that for GraphQL.
- Price: usually $50 to $60; check the current price on Amazon.
What a good API design book teaches
A good API design book teaches decisions that outlive the framework you build with. The fastest way to judge one is its table of contents: look for the problems that break clients. Before you buy any title not on this list, look for these five topics:
- Style selection: when REST, gRPC, GraphQL or async messaging fits, and what each costs your clients.
- Contract-first design: an OpenAPI, protobuf or GraphQL schema reviewed before any handler is written.
- Evolution and versioning: what counts as a breaking change and how to ship one without an outage.
- Collections: pagination, filtering and batch operations, where most early APIs go wrong.
- Authorization: object-level and function-level checks, not only authentication at the gateway.
Framework books (Spring, ASP.NET Core, FastAPI) usually cover none of these in depth, because their job is to get an endpoint running. They are worth owning for the stack you use, and our Spring Boot book picks and Go book list cover two common ones. Read one design book first, though, so the framework serves the contract rather than defining it.
A reading order for each team
Two books cover most teams, and the second depends on where your API sits. These are the pairs we would buy:
- Public or partner REST API: The Design of Web APIs, then API Design Patterns for the review vocabulary.
- Microservices talking over gRPC: Learning API Styles for the choice, then gRPC: Up and Running.
- Frontend-driven GraphQL: Learning API Styles, then GraphQL in Action.
- Platform or architecture team: Mastering API Architecture, then Patterns for API Design.
- Anyone exposing data to the internet: add Secure APIs to whichever pair you picked.
API design sits one level below the system design books most engineers read first. If you are preparing for interviews or designing whole systems rather than their interfaces, start with our best system design books, then come back here for the contracts between the boxes.
Where every API book trails the spec
All eight books lag the specifications they teach, and the gap is widest right now. The OpenAPI Specification reached 3.2.0 in September 2025 and 3.2.1 in September 2026, after seven of the eight picks went to print. The GraphQL spec’s September 2025 release postdates both picks with a GraphQL chapter. That does not make the books wrong, because the design reasoning carries over unchanged, but it does mean the spec is the source for syntax and the book is the source for judgment.
In practice we keep the current spec open next to whichever book the team is working through. Any code listing older than two years is pseudocode to us until it has been checked against the library’s current docs. That habit costs a few minutes per chapter and saves the afternoon you would otherwise spend debugging an API that was renamed in 2023.
