What is API (Application Programming Interface)?
Updated: 3 days ago
An API, or Application Programming Interface, is a defined interface that lets one piece of software interact with another without needing to know how the other system is implemented internally. An API specifies what operations are available, what inputs are accepted, how requests are made and what outputs or errors can be returned.
The important distinction is that an API is the interface or contract, not necessarily the network connection itself. Some APIs work entirely inside an operating system, browser or software library. Web APIs commonly exchange requests and responses across a network using HTTP or HTTPS.
How does an API work?
At a high level, a software client calls an operation exposed by an API. The receiving component interprets that request, applies its own rules and business logic, and returns a result. The interface separates the consumer from the implementation behind it, allowing both sides to evolve as long as the agreed interface remains compatible.
A client identifies the API operation or resource it wants to use.
It supplies the required inputs, which may include a URL, method, headers, parameters or a request body.
The API authenticates and authorises the request where required, validates the input and passes the request to the relevant application logic.
The service performs the requested operation, which may involve databases, other services or internal code.
The API returns a response containing a result, status information or an error.
What is a web API?
A web API exposes functionality over web technologies. Many web APIs use HTTP request and response semantics. RFC 9110 defines HTTP as a stateless application-level protocol and describes clients sending requests to servers, which return responses. An API can use that mechanism to expose resources and operations programmatically.
This is closely related to HTTPS, which carries HTTP over a secure transport, and TLS, which protects data in transit. HTTPS can protect the API connection, but it does not by itself decide whether a caller is authorised to access a particular API operation.
API request and response example
Imagine a broadband monitoring application that needs the latest status for a network device. Rather than reading the monitoring platform's database directly, it could call an API endpoint. The request identifies the device and the information required. The API checks the request, retrieves the permitted information and returns a structured response.
A response might use JSON because it is compact, text based and widely supported, but JSON is not mandatory. APIs can return XML, binary data, images, protocol-specific messages or other formats depending on the interface.
What are endpoints, methods and parameters?
Endpoint: the address or callable location for a particular API resource or operation. In an HTTP API this is commonly represented by a URI.
Method: the operation being requested. HTTP APIs can use standard HTTP methods such as GET, POST, PUT and DELETE according to the API design.
Path parameter: a value embedded in the path to identify a particular resource.
Query parameter: an additional value supplied in the query component of a URI, often used for filtering, paging or options.
Header: metadata accompanying the request or response, such as content type, authentication information or caching controls.
Request body: data sent with a request where the method and API design permit it.
Status code: in HTTP APIs, a three-digit HTTP status code communicates the outcome category and more specific result.
REST API vs API
API is the broad concept. REST is an architectural style for distributed systems and is not a synonym for API. An HTTP API can follow REST constraints closely, partially adopt REST-like conventions or use a different design entirely. Calling every JSON-over-HTTP interface a REST API hides important architectural differences.
REST vs SOAP vs GraphQL
REST: an architectural style centred on resources, representations and a uniform interface. REST is not a wire protocol or a data format.
SOAP: a messaging framework based on XML with formal standards for message structure and extensibility. It is still used in some enterprise and integration environments.
GraphQL: a query language and execution approach in which clients can describe the fields they need from a typed schema.
Are all APIs on the internet?
No. An API can exist between modules in the same application, between an application and its operating system, inside a browser, between devices on a local network or between services across the public internet. The browser APIs used by JavaScript are a good example of APIs that expose browser capabilities rather than a remote internet service.
API authentication and authorisation
Authentication establishes who or what the caller is. Authorisation determines what that authenticated caller is allowed to do. APIs can use API keys, signed requests, client certificates, OAuth-based access tokens, session credentials or other mechanisms. The right approach depends on the sensitivity of the operation and the system architecture.
API keys can identify a calling application but should not automatically be treated as strong user authentication.
Access tokens can carry or reference delegated permissions and should be protected like credentials.
TLS protects credentials and API data while they travel across the network when HTTPS is used correctly.
Authorisation should be enforced server side for every protected operation rather than trusted to the client application.
Secrets embedded in publicly distributed client code can often be extracted and should not be treated as private merely because they are hidden in an app.
What is an API rate limit?
A rate limit controls how many API operations a caller can make within defined conditions. Limits can protect capacity, reduce accidental overload, manage cost and make abuse harder. A rate limit is not the same as broadband bandwidth: one limits API operations according to policy, while the other describes network capacity.
What does an API have to do with broadband?
APIs are application-level interfaces, but remote API calls still depend on the network path underneath them. A request may traverse WiFi or Ethernet, a router, the access network, an ISP, internet routing and the remote service before a response returns.
That means API responsiveness can be influenced by latency, packet loss, congestion, DNS resolution, TLS setup, server processing and application design. More raw bandwidth does not automatically make a small API call feel faster if round-trip latency or server processing is the dominant delay.
Techie Broadband calculation: API payload vs broadband capacity
Consider a theoretical API that transfers a 100 KB response using decimal units. The payload alone contains 100,000 bytes × 8 = 800,000 bits. On a 100 Mbps connection, the payload-only transmission time is 800,000 ÷ 100,000,000 = 0.008 seconds, or 8 milliseconds.
This is a theoretical transmission calculation, not a prediction of the total API response time. DNS, connection establishment, TLS, request upload, HTTP framing, network latency, congestion, retransmissions, server processing and application parsing can all add time. It shows why a small API response may be latency-sensitive even when the broadband connection has plenty of capacity.
Why APIs can still feel slow on fast broadband
Round-trip latency can dominate when requests and responses are small.
An application may make several dependent API calls in sequence, causing delays to accumulate.
DNS lookup or connection establishment may occur before the request can be sent.
TLS handshakes can add round trips when a secure connection is not already established or resumed.
The remote service may spend significant time processing the request.
Rate limiting, queuing or service-side throttling can delay or reject requests.
Packet loss can trigger retransmission and increase completion time.
How DNS fits into an API request
When an application calls an API by hostname, DNS normally resolves that name to an IP address before the network connection is made, unless a usable result is already cached. DNS is therefore part of the path to many remote APIs, but it is not part of the API contract itself.
IPv4, IPv6 and APIs
A remote API can be reachable over IPv4, IPv6 or both. The application may use a hostname and let the operating system and network stack select a usable address. The API semantics can remain the same even when the underlying IP version changes.
Public, private and internal APIs
Public API: deliberately exposed for use by external developers or customers under published access conditions.
Partner API: exposed to selected organisations or integrations rather than the general public.
Internal API: intended for systems within one organisation or controlled environment.
Local API: exposed on the same device or local network, sometimes without any public internet path.
What is an API gateway?
An API gateway is an intermediary placed in front of one or more backend services. Depending on the implementation, it can route requests, enforce authentication, apply rate limits, transform messages, collect metrics and centralise policy. It is not a mandatory component of every API architecture.
What is an API specification?
An API specification describes the interface in a machine-readable or formally defined way. OpenAPI, for example, provides a language-agnostic interface description for HTTP APIs so humans and software tools can understand available operations and their inputs and outputs without reading the service source code.
How to troubleshoot an API that is not working
Confirm the endpoint, hostname, path and API version are correct.
Check DNS resolution and basic network reachability to the API host.
Confirm the required HTTP method, headers, parameters and body format.
Check authentication credentials, token expiry and authorisation scope.
Inspect the HTTP status code and the API's structured error response.
Check TLS certificate validation and system time if HTTPS negotiation fails.
Test whether a proxy, VPN, firewall or network policy is blocking the request.
Check rate-limit headers or service documentation if requests are being throttled.
Compare the request with the API specification or a known-good example.
If the network request succeeds but the API remains slow, separate network latency from server processing time using client and server timing data where available.
A firewall can block a connection before the application ever reaches the API. Conversely, a successful TCP or HTTPS connection proves reachability to the service but does not prove that the API request is valid or authorised.
Common API misconceptions
An API is not necessarily a website or web service.
An API is not automatically RESTful because it uses HTTP and JSON.
JSON is a data format, not an API architecture.
HTTPS encrypts transport but does not replace API authentication and authorisation.
An API key is not automatically equivalent to a user password.
A faster broadband package cannot fix slow server-side API processing.
An HTTP 200 response means the HTTP request succeeded according to the server's semantics, but the application-level result still needs to be interpreted according to that API.
Frequently asked questions
What does API stand for?
API stands for Application Programming Interface. It defines how software can interact with another software component or service.
Is an API the same as a web service?
No. API is the broader concept. A web service is a network-accessible software service and can expose an API, but APIs can also exist locally inside operating systems, browsers, libraries and applications.
Does an API always use HTTP?
No. HTTP is common for web APIs, but APIs can use other protocols or no network protocol at all.
What is an API endpoint?
An endpoint is a specific callable location or interface point for an API operation or resource. In an HTTP API it is commonly represented by a URI.
What is an API key?
An API key is a value used by some APIs to identify or authorise a calling application. Its exact security meaning depends on the API, and it should not automatically be treated as strong user authentication.
Does API traffic use broadband data?
Remote API traffic sent across your internet connection contributes to network data transfer just like other application traffic. The amount depends on request and response sizes, frequency and protocol overhead.
Authoritative references
The IETF HTTP Semantics specification, RFC 9110, defines the request and response semantics used by HTTP. The OpenAPI Specification describes a standard, language-agnostic interface description for HTTP APIs. MDN documents browser and web APIs and the distinction between APIs and human-facing interfaces.
Key takeaway
An API is a defined interface between software components. It tells a caller what it can ask for, how to ask, and what result to expect while hiding the implementation behind the interface. Web APIs often use HTTP or HTTPS, but API is a broader concept than either HTTP, REST or JSON. For remote APIs, broadband provides the network path, while DNS, IP, TLS, latency, packet loss, server processing, authentication and API design all influence what happens between request and response.
To explore the related technical concepts used in this API (Application Programming Interface) guide, visit our broadband terminology guide.
