Let me rephrase that: you are exposing a way to trivially traverse the entire object graph you&#x27;re exposing through the API, putting you at risk of DOSing your server when your friend Joe the frontend dev makes a small mistake in his query. You can obviously get the same result with REST, but usually you have to work a lot harder for it.