Choose per boundary, not per company
Do not pick a company-wide winner. Look at each boundary and ask who is calling across it, because these three styles are tuned for three different callers.
Give strangers REST. Third-party developers turn up with an HTTP client and your docs and nothing else, and REST asks nothing more of them. Responses cache in CDNs, curl works for debugging, and decades of shared understanding sit behind it.
The companies whose entire product is an API stay on REST even with the resources to build anything they like.
Give your own frontends GraphQL, once it earns its complexity. That happens when several client teams need different slices of the same data and you are tired of shipping a bespoke endpoint per screen.
Skip it if you have one web app and three screens, where a few well-shaped REST endpoints are simply less machinery. Watch for the organisational signal instead of a technical one: your frontend teams are blocked on your backend teams for every field they want.
Give your internal services gRPC. Both ends are yours, so being human-readable and universally reachable stops mattering, and the cost of each call starts compounding. Typed contracts catch integration bugs at compile time, and streaming and deadlines are built in rather than bolted on.
They compose
Compose them rather than choosing once. A common production shape is REST or GraphQL at the edge with gRPC behind it, where the gateway answers a query by making internal calls.
Name the boundary before you name the protocol in an interview. That is the whole difference between a memorised answer and a design decision.
Worked example
Priya is the architect at a 60-engineer fintech planning their API strategy. The debate has run for weeks as a personality contest, so she reframes it as three separate decisions. The partner-facing API that banks integrate with becomes REST, because bank IT departments integrate with curl and PDFs of documentation, and the existing v1 stays frozen for them. The mobile and web apps get a GraphQL gateway, ending the backlog of 40 screen-specific endpoint tickets. The 12 internal services, which exchange 20,000 calls per second, migrate pairwise to gRPC, starting with the two chattiest ones, where protobuf cuts inter-service bandwidth 70 percent. Nobody won the argument, which Priya considers the sign it was decided correctly: each boundary got the protocol its caller needed.