CoAP
HTTP's tiny cousin for constrained devices — request/response over UDP when even MQTT is too heavy.
In one line
CoAP (Constrained Application Protocol) brings the familiar web model — GET/PUT/POST on URLs — to devices so small that running TCP and HTTP would drain the battery.
The problem it solves
The smallest sensors — a battery-powered patch, an implant-adjacent node — can't afford the memory and energy of a TCP+HTTP stack, yet developers still want the simplicity of REST. CoAP gives them the web's request/response model in a few kilobytes, over UDP, so a constrained device can expose resources like any web server.
How it works
- Runs over UDP with a compact 4-byte header (vs HTTP's verbose text).
- REST semantics — a sensor exposes resources like
coap://device/vitals/hrthat a gateway simply GETs; PUT/POST to actuate. - Reliability is opt-in per message — "confirmable" messages get an acknowledgement; "non-confirmable" fire-and-forget for cheap streams.
- Observe extension — turns a GET into a subscription: the device pushes a notification whenever the value changes (like MQTT's pub/sub, but device-hosted).
- DTLS adds the security layer that TLS provides for TCP.
CoAP vs MQTT vs HTTP
| CoAP | MQTT | HTTP | |
|---|---|---|---|
| Transport | UDP | TCP | TCP |
| Model | REST request/response (+ observe) | pub/sub via broker | request/response |
| Footprint | tiny | small | heavy |
| Best for | constrained edge nodes | continuous telemetry to cloud | rich servers/clients |
The practical rule of thumb you'll use in the IoT lab: CoAP at the edge, MQTT between gateway and cloud, FHIR after that.
Where it shows up in digital health
Battery-powered wearables and implant-adjacent sensors where every milliwatt counts; smart-home health devices behind a hub; constrained nodes that a gateway translates to MQTT or HTTP before the data heads to a FHIR server.
Common pitfalls
- Forgetting DTLS — UDP with no security is wide open; constrained ≠ unprotected.
- Assuming TCP-like reliability — UDP can drop packets; use confirmable messages where it matters.
- NAT/firewall traversal — UDP can be harder to route across networks than HTTP.
Key takeaways
- CoAP = REST (GET/PUT/POST) over UDP for the most constrained devices.
- Observe gives push notifications; confirmable messages give opt-in reliability; DTLS secures it.
- Choose CoAP at the resource-poor edge; hand off to MQTT/HTTP upstream.
- Part of the edge → gateway → cloud → FHIR chain in medical IoT.
Check your recall
0 of 2 recalledActive recall beats re-reading — try to answer, then reveal.
What is CoAP, and why use it over MQTT or HTTP?
The edge rule of thumb for IoMT protocols?