What is an API?

API stands for Application Programming Interface and is basically a way for different software components to communicate with each other. Depending on the API, different protocols and data formats are used. APIs are generally intended for developers to provide structured access to specific functions or data.

Basic functionality of an API

This is quickly explained - usually the client-server model is used. Here, the client (a software, a developer) makes a request in a well-defined format to the server. The server responds with the requested data or performs specific actions.

What types of APIs are there?

SOAP

SOAP stands for Simple Object Access Protocol. Here, the data is exchanged between sender and receiver in XML format. It is simple and structured.

RPC

RPC was designed to execute defined complex procedures on remote servers or systems. You see it quite rarely and if you do, there's usually a very good reason for it, as it is typically high-performance.

WebSocket

WebSocket allows bidirectional communication between client and server. This is particularly interesting for real-time applications.

REST

REST is probably the most commonly used API protocol. It is simple, flexible, and is typically used for web applications. Data can be exchanged via HTTP.

Application examples for API

APIs are used in incredibly many things without us noticing. Our TVs, smartphones, and apps communicate with various APIs to get specific data. Every weather app accesses weather services' APIs to provide current data. The integration of payment service providers like PayPal or Stripe also happens via APIs.

More and more big data companies are offering their data via APIs. Behind this is often a payment model where users pay monthly for structured access to special data. Examples of this would be companies like SecurityTrails, Shodan, or ZoomEye.

How are APIs documented?

For REST APIs, Swagger or OpenAPI is typically used. Here, the API is documented in a JSON format. This type of format is both easy to read and understand, and can be automatically imported into other tools. Depending on which framework is used as the basis for the API, there may be the possibility that the documentation is generated automatically.

API Security

APIs are a popular attack target. Therefore, secure configuration and implementation are all the more important. Special attention should be paid to authentication and authorization. Data transmission should also be encrypted. A simple way of authentication is the use of API keys. Regular API penetration tests are also recommended.