REST wins when your consumers are external, your resources are stable, and caching at the HTTP layer matters — think public APIs, webhooks, anything a third party has to trust for years.
GraphQL earns its complexity when a handful of frontends need very different shapes from the same underlying data and you are tired of versioning endpoints just to add a field a mobile team asked for.
Most enterprise systems I’ve built end up with both: a stable REST surface at the edge, and GraphQL (or a well-designed BFF) sitting in front of it for the internal apps that iterate fast. Pick per consumer, not per company.
