Full comment
Where to start... First, nowadays altering the DOM is way more responsive than loading a new page, so no one really wants HATEOAS -- not even users, but especially not the sites we like to visit because they don't want to put out public APIs anymore. For non-browser app APIs (public or private), well, they can be the same, just driven by JS when in-browser. This... is sad. But this is a fact of life now. Just watch Tom Scott explain why the APIs went away, and when the APIs went away, so did HATEOAS ( this video ). Second, there's a lot of APIs that needn't have anything more than one end-point -- no links to traverse, no HATEOAS. For example, a certification authority can take a CSR and authentication and return you a certificate -- one end-point is all you need, and other than that, the API can be RESTful in every sense. And then there's APIs where links aren't necessarily abundant or interesting. Third, HTTP kinda sucks anyways if you're dealing with databases. There's no nice RESTful way to construct transactions unless you put the RDBMS smarts into the client (JS again), which you can't do if it means trusting the client (it does). So right there, REST is broken anyways. Sure, if you're distributing your database, you need to deconstruct your transactions anyways, but you're not going to trust a user-agent to get that right, and anyways, you can't really do that with a HATEOAS interface. Put another way: show us how to build a secure application with REST (including HATEOAS