CoAP

In one line

CoAP (Constrained Application Protocol) brings the familiar web model — GET/PUT/POST on URLs — to devices so small that running TCP and HTTP would drain the battery.

The problem it solves

The smallest sensors — a battery-powered patch, an implant-adjacent node — can't afford the memory and energy of a TCP+HTTP stack, yet developers still want the simplicity of REST. CoAP gives them the web's request/response model in a few kilobytes, over UDP, so a constrained device can expose resources like any web server.

How it works

• Runs over UDP with a compact 4-byte header (vs HTTP's verbose text).
• REST semantics — a sensor exposes resources like coap://device/vitals/hr that a gateway simply GETs; PUT/POST to actuate.
• Reliability is opt-in per message — "confirmable" messages get an acknowledgement; "non-confirmable" fire-and-forget for cheap streams.
• Observe extension — turns a GET into a subscription: the device pushes a notification whenever the value changes (like MQTT's pub/sub, but device-hosted).
• DTLS adds the security layer that TLS provides for TCP.

CoAP vs MQTT vs HTTP

	CoAP	MQTT	HTTP
Transport	UDP	TCP	TCP
Model	REST request/response (+ observe)	pub/sub via broker	request/response
Footprint	tiny	small	heavy
Best for	constrained edge nodes	continuous telemetry to cloud	rich servers/clients

The practical rule of thumb you'll use in the IoT lab: CoAP at the edge, MQTT between gateway and cloud, FHIR after that.

Where it shows up in digital health

Battery-powered wearables and implant-adjacent sensors where every milliwatt counts; smart-home health devices behind a hub; constrained nodes that a gateway translates to MQTT or HTTP before the data heads to a FHIR server.

Common pitfalls

• Forgetting DTLS — UDP with no security is wide open; constrained ≠ unprotected.
• Assuming TCP-like reliability — UDP can drop packets; use confirmable messages where it matters.
• NAT/firewall traversal — UDP can be harder to route across networks than HTTP.

Key takeaways

• CoAP = REST (GET/PUT/POST) over UDP for the most constrained devices.
• Observe gives push notifications; confirmable messages give opt-in reliability; DTLS secures it.
• Choose CoAP at the resource-poor edge; hand off to MQTT/HTTP upstream.
• Part of the edge → gateway → cloud → FHIR chain in medical IoT.