What is the Richardson Maturity Model for REST APIs?
Understand the Richardson Maturity Model's four levels for REST APIs, from RPC over HTTP to resources, verbs and HATEOAS, with examples and interview questions.
Expected Interview Answer
The Richardson Maturity Model is a four-level scale (Level 0 to Level 3) that grades how closely a web API follows REST principles, from a single RPC-style endpoint up to a fully hypermedia-driven API.
Level 0 uses one URI and one HTTP method (often POST) for everything, essentially RPC over HTTP. Level 1 introduces resources with distinct URIs. Level 2 adds proper HTTP verbs (GET, POST, PUT, DELETE) and status codes. Level 3 adds hypermedia controls (HATEOAS) so responses link to related actions. Each level builds on the previous one and moves the API closer to being truly RESTful.
- Provides a clear vocabulary to assess API design
- Highlights the value of resources, verbs and status codes
- Shows a path to incrementally improve an API
- Clarifies where HATEOAS fits in REST
- Helps teams agree on what 'RESTful' means
AI Mentor Explanation
Think of a young cricketer maturing in stages: first just slogging every ball the same way, then learning distinct shots, then reading the field to pick the right stroke, and finally anticipating the bowler and guiding teammates. The Richardson model grades an API in the same four stages, from one crude endpoint up to a fully hypermedia-aware, self-guiding design.
Step-by-Step Explanation
Step 1
Level 0 - The Swamp of POX
A single URI and usually one HTTP method (POST) handle every operation, essentially RPC tunnelled over HTTP.
Step 2
Level 1 - Resources
The API introduces multiple URIs so each entity, such as /orders or /users/5, is its own addressable resource.
Step 3
Level 2 - HTTP verbs
Standard methods (GET, POST, PUT, DELETE) and meaningful status codes are used for the right operations.
Step 4
Level 3 - Hypermedia controls
Responses embed HATEOAS links telling clients which actions and transitions are available next.
Step 5
Assess and improve
Use the levels to diagnose an API's current maturity and plan concrete steps to move it higher.
What Interviewer Expects
- Knowing all four levels in order
- Correctly placing HTTP verbs at Level 2
- Placing HATEOAS at Level 3
- Explaining Level 0 as RPC over HTTP
- Understanding it as a diagnostic, not a strict standard
Common Mistakes
- Mixing up the order of the levels
- Putting HATEOAS at Level 2 instead of Level 3
- Thinking every API must reach Level 3 to be good
- Confusing resources (Level 1) with proper verb use (Level 2)
- Treating the model as an official REST specification
Best Answer (HR Friendly)
“The Richardson Maturity Model is a simple four-step scorecard that tells you how RESTful an API is. It goes from a basic single-endpoint design up to one that uses separate addresses for each thing, the right web actions, and finally links that guide the app on what it can do next.”
Code Example
# Level 0 (RPC over HTTP): one endpoint, one verb
POST /api
{ "action": "getOrder", "id": 1042 }
# Level 2 (resources + verbs + status codes)
GET /orders/1042
# -> 200 OK { "orderId": 1042, "status": "PAID" }
DELETE /orders/1042
# -> 204 No ContentFollow-up Questions
- What is the difference between Level 2 and Level 3?
- Why is Level 0 called the Swamp of POX?
- Does an API need Level 3 to be considered RESTful?
- How do HTTP status codes fit into Level 2?
- How would you move a Level 1 API to Level 2?
MCQ Practice
1. Which level of the Richardson Maturity Model introduces HTTP verbs and status codes?
Level 2 adds proper use of HTTP methods and meaningful status codes on resource URIs.
2. What characterises Level 0?
Level 0, the Swamp of POX, funnels everything through one URI and usually one method, resembling RPC over HTTP.
3. Which feature defines Level 3?
Level 3 adds hypermedia controls so responses link to available next actions, the HATEOAS constraint.
Flash Cards
How many levels are in the Richardson Maturity Model? — Four levels, from Level 0 to Level 3.
What does Level 1 add? — Multiple resource URIs instead of one generic endpoint.
What does Level 2 add? — Proper HTTP verbs (GET, POST, PUT, DELETE) and meaningful status codes.
What does Level 3 add? — Hypermedia controls (HATEOAS) linking to available next actions.