Graphql is bit to far out for my situation, but I agree with your observation that REST tends to expose too much of the underlying model to the client: The client becomes quickly tightly coupled with the underlying data model if you aren't paying attention. I've been bitten by that dog already :)