What is an API (application programming interface)?

How do APIs work? 

APIs define how software communicates. They specify how an application requests services from an operating system, a library or another application, and how those services exchange data.

Any data can be shared with an application programming interface. APIs expose data or functionality through defined endpoints or function calls comprised of verbs and nouns. The required syntax is documented by the API provider. For example, on a real estate website, one API might provide property listings by geographic area, while another provides current interest rates and a third offers mortgage calculations.

APIs are made up of the following two related elements:

• A specification that describes how information is exchanged between programs -- in the form of a request for processing -- and a return of the necessary data.
• A software interface written to that specification and published in some way for use.

This architecture is typically described in client-server terms. The application sending a request is the client, and the application sending the response is the server. The API bridges the connection between them.

The client that wants to access the features and capabilities of the API is said to call it, and the server that creates the API is said to publish it.

APIs authorize and grant access to data that users and other applications request. Access is authenticated to a service or portion of functionality using predefined roles that govern who or what service can access specific actions and data. APIs also provide an audit trail that details who and what had system access and when it happened.

Applications that call APIs were traditionally written in specific programming languages. Web APIs can be called through any programming language, but webpages created in Hypertext Markup Language (HTML) or application generator tools can also access them.

The most common architectures for APIs are Representational State Transfer (REST) and Simple Object Access Protocol (SOAP), which defines a standard communication protocol specification for a message exchange based on Extensible Markup Language or XML. SOAP requires less low-level infrastructure-related code than REST. However, REST APIs are easier to scale and redeploy, and simpler to implement and integrate with websites and services. REST APIs are most often used today, particularly for web interactions.

WebSocket APIs are another form of API. They use JavaScript Object Notation objects to transfer data. WebSocket APIs also provide callback functions to enable two-way communication between clients and servers. These are commonly written in JavaScript, Python, C#, Go, Ruby and other languages.

Remote Procedure Call (RPC) APIs enable clients to call other processes on remote systems as if the process were a local system. RPC APIs are typically written in C++, Java, Python, Go, Ruby and .NET.

Why APIs are important for business

APIs have improved the quality and delivery of software and services. Custom software that was developed for a specific purpose is often written to reference APIs that provide features that are useful in a variety of contexts. This reduces development time, cost and the risk of errors.

The growing number of web services that cloud providers expose through APIs also has encouraged the creation of cloud-specific applications, IoT efforts and apps to support mobile devices and users.

APIs add a digital layer through which a company's data and enterprise assets are presented with requisite governance and security. This approach enhances customer, employee and partner interactions. Greater functionality and scope of services increase the value delivered to users and improve the customer experience.

APIs enable developers to save time creating an application by integrating data, services and other capabilities from other applications, so the developer does not need to create them from scratch. APIs also create new monetization opportunities for businesses, such as the productization of data with customized packages and plans for business partners.

Types of APIs

There are four types of APIs:

• Private APIs, or internal APIs, are published internally for use by a company's developers to improve its own products and services. Private APIs aren't exposed to third parties.
• Public APIs, or open APIs, are published publicly for anyone to use. There are no restrictions on these APIs.
• Partner APIs can only be used by specific parties with which a company agrees to share data. These APIs are often used in business relationships to integrate software between partnering companies.
• Composite APIs combine multiple APIs to address related or interdependent tasks. They often improve speed and performance compared with individual APIs.

APIs are also classified based on their scope and nature of interactions.

• Local APIs offer OS or middleware services to applications. Examples of local APIs include Microsoft's .NET APIs, the telephony API for voice applications and database access APIs.
• Web APIs are designed to represent resources such as HTML pages and are accessed using a simple Hypertext Transfer Protocol, or HTTP. Any web URL activates a web API. Web APIs are often called RESTful APIs because the publisher of REST interfaces doesn't save any data internally between requests. As such, requests from many users can be intermingled as they would be on the internet.
• Remote APIs interact through a communication network to manipulate resources outside of the computer making the request. This is a broader category that includes but isn't limited to web APIs. Remote APIs don't need to be designed based on web standards, though many are. The Java Database Connectivity API and the Java Remote Method Invocation API are two examples of remote APIs.
• Program APIs are based on RPC technology that makes a remote program component appear to be local to the rest of the software. Service-oriented architecture (SOA) APIs, such as Microsoft's Web Services series of APIs, are program APIs.

Why API design matters

Good API design is critical for successful API use. Software architects spend considerable time reviewing all the possible applications of an API and the most logical way for it to be used.

The data structures and parameter values are of particular importance, as they must match between the caller of an API and its publisher.

Strong API security is also an important aspect of their design. Exploitation of misconfigured APIs is a common practice for cyber attackers. An API is a gateway that presents an organization's systems and data to internal and external users. Any compromise can create broad and serious security problems.

If an organization is planning to sell its API as a form of monetization, then it's important that it works as intended, so it can get in front of as many people as possible.

How to create an API

Developers must follow these steps to create an API:

1. Planning. Developers define the purpose, scope and functionality of the API. Clear documentation is important to align development efforts with business and user needs. An API specification such as OpenAPI is a standard format that can help provide a blueprint.
2. Building. Developers begin building the API based on previously outlined specifications. This process involves creating architecture, writing code to handle requests and responses and integrating third-party services or back-end systems.
3. Testing. This stage focuses on validating functionality, performance and API security.
4. Documenting. This stage focuses on creating clear explanations of endpoints, request parameters, response formats and error codes. Good documentation helps improve third-party developer user experiences. Documentation should be kept clear and current.
5. Publishing. Developers publish the API to a developer portal or API marketplace where third parties can find and use it. Continuous monitoring and updates help ensure the API continues to be used.
6. Discontinuing. An API is removed from service when its support and development -- including bug fixes -- stop. It might be replaced with a newer version of the API or a new API product.

What are examples of APIs?

Operating systems and middleware expose their features through collections of APIs, which are often packaged in frameworks, libraries and software development kits (SDKs). Different implementations that support the same API specifications allow developers to use the same code across multiple platforms, improving compatibility and interoperability.

Many software products and tools deliver functionality via APIs, including:

• DevOps tools such as Docker, GitLab and Jenkins.
• Enterprise platforms such as Microsoft SharePoint.
• Social media platforms.

Social media in particular takes advantage of APIs to facilitate third-party functionality, such as the ability to create news feeds and share photos. Access to social media APIs has become more restricted over time.

The internet has been a major driver of API adoption. Providers such as Meta and Google publish APIs that enable developers to integrate their services into third-party applications. These APIs support capabilities such as user authentication, mapping, messaging, payments, cloud services and AI models. They have enabled a wide range of web and mobile applications, as well as emerging technologies such as augmented reality, connected devices and generative AI.

Modern APIs are most commonly associated with:

• Cloud services.
• SaaS integrations.
• AI.
• IoT.
• Automation.

One real world example of an API is WeatherKit, also called WeatherKit REST API. This Apple web service can be used to provide weather data to applications and services. A third-party weather app, for example, could use WeatherKit to retrieve weather data from Apple and provide it on its own app. WeatherKit is available for iOS, macOS, tvOS and watchOS apps.

Another example is the Google Maps API. This enables developers to embed interactive maps and display locations, calculate routes and retrieve other geographic information using applications. A food delivery app might use the Google Maps API to display restaurants nearby, estimate delivery times or provide navigation services.

What are the benefits of using APIs?

APIs are a set of rules. They standardize how developers write application code, improving an organization's internal software development processes.

Using the same rules and formats streamlines code, making it more transparent. Standardization also facilitates collaboration among developers as they build software components with the intent to integrate with APIs. This, in turn, facilitates feature development and reduces time to market.

Public APIs and ones shared with partners enable an organization to do the following:

• Securely control and manage how users and systems access data and service functionality.
• Allow third parties to use its data -- even in a limited sense -- which increases a company's brand exposure.
• Grow its customer database and increase its conversion rate by aligning its services with other trusted brands.
• Monetize its APIs so that they become a line of revenue. This is a common tactic for online payment gateways. For example, companies that use PayPal's APIs are willing to pay to use a trusted payment system.
• APIs separate the requesting application from the responding service, providing additional security between client and servers.

Challenges of using APIs

There are also challenges and limitations associated with APIs, including the following:

• API development can be complex and costly to integrate with the systems and data they represent. Certain types of functionality might be better addressed through an approach such as robotic process automation.
• Because they're driven by standardization, APIs are also vulnerable to cyberattacks related to data exposure, user authentication, object-level and function-level authorization, mass assignment and injection attacks.
• APIs are frequently updated, making it difficult to keep API documentation up to date. Proper API lifecycle management and deprecation of old APIs can help mitigate this challenge.
• Compatibility and integration issues, as some APIs use different data formats, can make it difficult to share data, slowing down response times.
• APIs must be tested to ensure they perform as needed. The best approach is to codify testing practices.

API trends

The ubiquity of the internet, expanded use of cloud computing and a shift from monolithic applications to microservices have all contributed to increased API use.

Some modern API trends that continue to gain traction include the following:

Artificial intelligence in APIs. 

AI and machine learning are increasingly being used for all sorts of tasks including software development. Organizations use APIs to integrate AI and LLMs into applications. AI agents also use APIs to interact with external tools.

API security

As the API's have become more widely-used, securing them has become a top priority. Best practices for API security include authentication and authorization, encryption, rate limiting, API gateways and continuous monitoring. See API management for more information.

API observability

Observability tools help developers and operations teams monitor API performance, availability and reliability. By collecting metrics, logs and distributed traces, organizations can identify bottlenecks, troubleshoot failures and optimize API performance.

API-first development

It's common now to adopt an API-first approach, designing APIs before implementing application logic. This approach encourages consistent interfaces, simplifies integration between development teams and enables applications to be built more easily across web, mobile and cloud platforms.

Multiple API styles

GraphQL, gRPC and event-driven APIs have to come to be significant alternatives to the default REST architecture.

Established API practices and past trends

Many past trends around APIs have now become established practices. These include the following:

REST and the web. 

Web API calls can come from any programming language. They can also be made by webpages created in HTML or application generator tools. Both REST and SOAP can invoke and connect to, manage and interact with cloud services. REST is the preferred for web APIs because it uses less bandwidth and offers more options for programming languages such as JavaScript and Python. Large websites, such as Amazon, Google, LinkedIn and Twitter, use RESTful APIs.

APIs and the cloud. 

Cloud computing introduced new capabilities to divide software into reusable components, connect components to requests and scale the number of copies of software as demand changes.

These cloud capabilities shifted the focus of APIs from simple RPC-based programmer-centric models to RESTful web-centric models, and to functional programming or lambda models of services that can be instantly scaled as needed in the cloud.

In the early days of Web 2.0, the concept of integrating data and applications from different sources was called a mashup. The web, software designed to exchange data via the internet and cloud computing have all combined to increase the interest in APIs and services.

APIs as services. 

The trend of thinking of APIs as representing general resources has changed. Many applications use APIs as a general tool, but they're also considered services and normally require more controlled development and deployment. Many organizations also choose to monetize their APIs so that other organizations can use them for subscription or usage-based pricing. SOA and microservices are examples of service APIs.

OpenAPI 

This is also a best practice to follow when developing standard APIs. OpenAPI is a specification that defines and documents RESTful APIs. It describes API functionalities, operations, responses as well as details for HTTP-based APIs.

Automation 

This has also become an important factor in the design of APIs, as it helps streamline API development and testing. Automation tools are also used to check for adherence to governance and standard policies.

API publishing and management

The company that publishes the API controls all aspects of its design and use, including security, reliability and charging for use. It also controls the addition of functions, whether they're developed by the publisher or third parties. That means the company must uphold API performance under its terms of service, as it would with any application or service.

The following are key aspects of API management and publishing:

API testing. 

Like all software, APIs must be tested. This validates the published API against the specifications that users employ to format their requests. API testing also ensures the following:

• Application endpoints and data-sharing functions work as expected.
• Partners' data feeds send the expected data, how, when and where it's expected.
• Junk data doesn't enter a database and create application problems or data corruption issues.
• An application functions across all platforms, including desktop, web and mobile.

API testing is usually done as part of application lifecycle management, both for the software that publishes the API and for all the software that uses it. APIs also must be tested in their published form to ensure they can be accessed properly.

API management. 

API management refers to the set of activities associated with publishing an API for use. Management enables users to find the API and its specifications and regulate access to it based on owner-defined permissions or policies.

API management has become prevalent as businesses increasingly depend on APIs, adopt more of them and deal with the administrative complexities they introduce. Organizations have different management needs, but they typically encompass basic functions, including security, governance, analytics and version control.

APIs require strong documentation, advanced levels of security, comprehensive testing, routine versioning and high reliability. To address these requirements, organizations use API management software, either as a combined platform or with individual tools. These tools typically involve several core components: a developer portal, lifecycle management, a policy manager, analytics, an API store and an API gateway.

API endpoints and security. 

API endpoints are the points where the client and server communicate, and where the API receives resource requests. They're typically a URL exposed by the server that enables other systems to connect to the endpoints. They function as entry points into the corporate network. Endpoints are where a developer's code interacts with an organization's code and data.

API endpoints are attractive targets to attackers and must be protected. Some security measures are as follows:

• Use rate limiting to discourage bots and distributed denial of service threats.
• Validate input to ensure correct data is coming in and to prevent injection attacks.
• Store passwords as asymmetric hashed values.

Find out how to build an enterprise API strategy with this comprehensive guide.