Engine-rest vs api

Hi,
I know two ways to work with BPM services: via external application “engine-rest” and via build-in API for “camunda” application:
http://localhost:8080/engine-rest/user/
vs
http://localhost:8080/camunda/api/engine/engine/default/user

When you config “camunda” application to work with SSO, it services already can clear authenticate your connection by kerberos spnego technology.
So why do I need “engine-rest” and is it recomeded to use build-in services of “camunda” application ?