REST APIs are deceptively simple on the surface but notoriously inconsistent in practice — different teams implement auth, pagination, and error handling completely differently. AI tools struggle because there's no single 'correct' REST — every API is its own dialect. GraphQL and gRPC have stricter contracts which makes them easier for AI to reason about. The irony is that this inconsistency is also why REST APIs have so many security vulnerabilities — no standard means no standard security either.