Performance considerations for ICAP or REST API in Symantec Protection Engine

Products

• Protection Engine for Cloud Services

Issue/Introduction

You would like to know which option provides better performance/ transfer speed in SPE. 

Resolution

In general, ICAP is purpose-built for real-time content scanning and is highly efficient in that role. The REST API offers more flexibility for application integration but introduces a bit more overhead.

It is worth noting that the REST API actually leverages ICAP internally. When you send a file through the REST interface, SPE first writes it to a temporary directory, then transfers it to itself over 127.0.0.1 using ICAP. The scan result is returned internally to SPE and then passed back to the calling application via REST.

The advantage of the REST API is simplicity — it’s easier for developers to integrate compared to building or sourcing an ICAP client.
However, if you use ICAP directly, you have more control and can achieve the highest possible throughput, provided your ICAP client is well-optimized.

One important note: when using the REST API, Secure ICAP cannot be enabled. In a mixed environment (both ICAP and REST), enabling Secure ICAP will cause REST API requests to fail.

In summary:

• Fastest throughput: ICAP

• Simpler integration: REST API