Application programming interfaces (APIs) are software interfaces that open up an application’s data in a way that allows other applications to access it in a uniform manner, facilitating communications between applications.

To access an application’s internal data, other applications can simply make an API call (request) to the application’s API. The API interprets and fulfills the request, returning the relevant information in a response.

For applications on different machines to communicate over a network, a communication protocol is required. For most REST APIs, HTTP is the protocol of choice.

HTTP uses a client–server architecture in which clients send requests and servers send responses.

The essential actions that can be taken on a resource are called CRUD (Create-Read-Update-Delete) operations.

An HTTP request can include various pieces of information. The two key elements are the HTTP method (also called the HTTP verb), which defines the request’s desired action (CRUD operation), and the Uniform Resource Identifier (URI), which indicates the target of the request.

HTTP methods can generally be mapped to one of the four CRUD operations: create (POST), read (GET), update (PUT, PATCH), and delete (DELETE).

An HTTP response uses a similar format to an HTTP request. The key element is the response code, which indicates the result of the request.

There are five main categories of HTTP responses, indicated by their first digit:

• 1xx informational

• 2xx successful

• 3xx redirection

• 4xx client error

• 5xx server error

Representational State Transfer (REST) is a type of software architecture that forms the basis of the World Wide Web. APIs that conform to REST architecture are called REST APIs or RESTful APIs.

REST architecture is defined by six constraints:

• Uniform interface

• Client-server

• Stateless

• Cacheable or noncacheable

• Layered system

• Code on demand (optional)

REST APIs employ a client-server architecture. The client and server applications must be able to change and evolve independently without breaking the interface between them (the API).

REST API exchanges are stateless, meaning that each API exchange is a separate event, independent of all past exchanges between the client and server.

The server does not store information about previous requests from the client to determine how it should respond to new requests.

If a resource is cacheable, it means that it can be cached—temporarily stored for reuse. This can significantly improve efficiency because there’s no need to retrieve the same resource repeatedly when accessing it multiple times.

Frequently updated and sensitive information should not be cached. Caching such data could lead to outdated information being displayed, and it poses a security risk if sensitive data is stored inappropriately.

In REST architecture, resources can be cacheable or noncacheable, but they must be marked as such, whether implicitly or explicitly.

REST APIs can use a variety of methods to authenticate requests. Some common authentication types include basic authentication, bearer authentication, API key authentication, and OAuth 2.0.

Basic authentication uses a username and password (provided in the HTTP header) for authentication. While simple and convenient to implement, it is not considered secure.

In bearer authentication, the client obtains an access token from an authorization server, which it then uses to access the desired resource. The token is typically valid for a limited time, requiring renewal for continued use.

API key authentication involves the use of a unique identifier assigned to each client application. The client application includes this key in its API calls, similar to an access token used in bearer authentication. The API key uniquely identifies an application, not a user.

Unlike access tokens, API keys typically do not automatically expire, making them less secure if not managed properly.

Open Authorization 2.0 (OAuth 2.0) is an industry-standard framework that provides access delegation, allowing third-party applications to access resources (i.e., via a REST API) on behalf of a user without sharing the user’s credentials.