What Is an API?

An application programming interface (API) is a way that one piece of software uses the functionality of another piece of software.

What Is an Application Programming Interface (API)?

An application programming interface (API) is a set of rules that enables one program to transfer data to another. APIs allow developers to avoid redundant work; rather than building and rebuilding functionality that already exists in applications, developers can integrate existing functionality into their new applications by formatting requests as the API requires.

Therefore:

An API is an “interface,” meaning a means for one thing to interact with another. As a real-world example, an ATM machine has an interface – a screen and several buttons – that allows customers to interact with their bank and request services, such as getting cash. Similarly, an API is how one piece of software interacts with another piece of software to obtain required services.

Also:

Imagine that Jennifer is building a website that helps commuters check highway traffic conditions before leaving for work. Jennifer could spend a lot of time and money creating a complex system to track highways in order to provide this information to her website’s users. But these capabilities already exist, as third parties have built such systems. Rather than reinventing the wheel in this way, Jennifer’s website uses an API provided by an external highway tracking service. Now Jennifer can focus on building other aspects of the website.

What Is an API Call?

An API call, also known as an API request, is a message sent to an API that triggers use of the API. Returning to the example, Jennifer builds her website in such a way that when it loads, it automatically generates an API call to the highway tracking service. The response comes back to the website from that service and enables it to display the latest highway traffic information.

API calls must be formatted according to the API’s requirements in order to work. The API’s requirements are called its “schema.” The schema also describes the types of responses that are provided for each request.

Also:

Suppose a commuter uses Jennifer’s website to check traffic on Highway 192. The website sends an API call to provide this information – a message that reads “Highway 192.” The API server of the highway tracking service receives this message and responds with travel times on Highway 192. Imagine the API schema in this way:

(Note that this is for illustrative purposes – real-world API requests, responses, and schemas are more complex.)

Now suppose Jennifer’s website sends an API request for “Highway ASDFGHJ.” This is not a valid request because it does not conform to the API schema, which only allows actual highway names. The server will not be able to provide a usable response to such a request.

What Is an API Endpoint?

An endpoint is the end of a communication channel. An API endpoint is where an API response originates.

In the example, the API communication client is Jennifer’s website, and the endpoint is the server hosting the API. Jennifer’s API calls must go to a specific URL (a URL is a web address, such as www.ezznology.com) that the API server is responsible for in order to receive a response.

What Is API Integration?

API integration is a combination of two or more applications using APIs. API integration is what enables one application to leverage the capabilities of another application, just as combining a sales team and a marketing team in a single office enables these two teams to work together and benefit from each other’s efforts. API integration is also commonly used to synchronize data between two applications or databases.

What Is a Web API?

Anything that involves computer code can have an API, from operating systems to software libraries. A web API is intended for use by web applications that are accessed via the Internet.

Also:

Web APIs are extremely important to the modern Internet. Almost all user-facing applications rely on APIs (not just Jennifer’s website!). Entire software development philosophies are based on the use of APIs – one such philosophy is JAMstack, where JAM stands for JavaScript, APIs, and markup. Another example is microservices architecture, which uses APIs to call the various functions that make up the application. Even applications built without these approaches typically rely on APIs.

What Are SOAP APIs and REST APIs?

SOAP APIs and REST APIs describe different categories of APIs.

SOAP (Simple Object Access Protocol) is a type of protocol. SOAP APIs are APIs that use the SOAP protocol exclusively.

REST (Representational State Transfer) is an architectural style for web services. A REST API is any API built using REST architecture. Unlike SOAP APIs, REST APIs work with any protocol. Most APIs today are REST APIs.

Do APIs Present Security Risks?

Just as allowing a person to use an application introduces the risk of that person misusing the application, an API introduces the risk of an API client abusing the service. Additionally, web API calls travel over the Internet and can be intercepted, spoofed, or altered just like any other data transmission over a network.

Therefore:

API security is the practice of protecting APIs from attacks and abuse. Given the importance of APIs to the modern Internet, API security is a critical component of web application security. Key API security measures include:

• Rate limiting: Clients that make too many API requests can slow down or crash the API for other clients. Rate limiting sets a maximum number of API requests that can come from a given API endpoint within a given time frame.
• DDoS protection: Similar to rate limiting, distributed denial-of-service (DDoS) protection stops DDoS attacks, which aim to overwhelm or crash the API with a large number of requests sent all at once.
• Authentication: It is important to authenticate API endpoints and clients to ensure that API requests come from legitimate sources and not from attackers, for example. Mutual TLS (mTLS) is one of the most effective forms of API authentication.
• Schema validation: If an API request does not conform to the API schema, the API may respond in unexpected ways – by exposing confidential data, for example. Schema validation allows the API to drop such requests.