What makes an API RESTful?

Model answer

REST is an architectural style, not a protocol. A RESTful API follows a few constraints:

Resources are identified by URLs (/users/42), and you act on them with standard HTTP methods: GET reads, POST creates, PUT or PATCH updates, DELETE removes.
Stateless: every request carries all the information the server needs. No session is kept between calls.
Uniform interface: consistent naming, representations such as JSON, and meaningful status codes.
Cacheable responses, marked with headers like Cache-Control and ETag.
Client-server separation, and a layered system with proxies or gateways in between.

Safe methods (GET) must not change state. GET, PUT and DELETE are idempotent. Many "REST" APIs skip hypermedia links (HATEOAS), which Roy Fielding's original definition includes.

Key points

Resources identified by URLs and manipulated with HTTP methods
Stateless requests: no server-side session between calls
Uniform interface with meaningful status codes
Cacheable and layered

Likely follow-ups

What is the difference between PUT and PATCH?
What is HATEOAS and do you use it?

Common mistakes

Putting verbs in URLs, such as /getUser
Using POST for everything