What is an API?

In other fields, API means something else. In the oil industry it is the American Petroleum Institute, as in "API gravity", and in medicine it is an active pharmaceutical ingredient. This page is about the computing meaning.

What does API stand for, word by word?

• Application: any piece of software, from a phone app to a bank's servers.
• Programming: it is used by programs and the people who write them, not by the end user.
• Interface: a boundary where two things meet. A screen and buttons are an interface for people; an API is an interface for software.

The best known way to picture it is a restaurant. You (the client) don't walk into the kitchen. You order from a menu through a waiter (the API), the kitchen (the server) makes the food, and the waiter brings back your meal (the response). The menu is the API's documentation: it lists what you can ask for and how.

How does an API work?

Most APIs you hear about are web APIs, which work over the same HTTP connection your browser uses. The pattern is always request, then response:

1. The client sends a request to a web address called an endpoint, saying what it wants.
2. The server checks the request, does the work, perhaps looking something up in a database.
3. The server sends back a response: a status code saying whether it worked, and usually some data.

The client never sees the server's code or database, only what the API chooses to give it. That is the point of an API: the server can change everything inside, and as long as the API stays the same, every app using it keeps working.

A real API request and response

GitHub has a public API that anyone can try. This request asks for the profile of GitHub's mascot account, octocat:

GET https://api.github.com/users/octocat

The response starts with the status 200 OK, then the data in a format called JSON. Here is part of the reply we received on 7 November 2026:

{
  "login": "octocat",
  "name": "The Octocat",
  "company": "@github",
  "location": "San Francisco",
  "public_repos": 8,
  "created_at": "2011-01-25T18:44:36Z"
}

A program can read that and use any part of it, for example to show the name and location on a page. You can paste the address into your browser to see the full reply yourself. Without a key, GitHub allows 60 requests an hour from one IP address; developers who need more sign in with a token.

What is an API call?

An API call is one request sent to an API, together with its response. The GitHub example above is one API call. Services often count, limit and charge by API calls, so "1,000 API calls a day" means 1,000 requests.

Each call uses an HTTP method to say what kind of action it wants. These are the five you will meet most:

GET, POST, PUT and DELETE are defined in the HTTP standard, RFC 9110, and PATCH in RFC 5789. Try one: this question describes a job and asks which method the call should use.

Status codes: did the call work?

Every response has a three digit status code. Codes starting with 2 mean success, 4 means the client got something wrong, and 5 means the server had a problem. The ones you'll see most are 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, 429 Too Many Requests and 500 Internal Server Error.

What is a property in an API?

Most web APIs send data as JSON, which is made of objects in curly brackets. Each name and value pair inside an object is a property (also called a field or key). In the GitHub reply, "location": "San Francisco" is a property: its name is location and its value is San Francisco. API documentation lists the properties each response contains, what type each one is (text, number, true or false, a list or another object) and what it means.

In code, you read a property with a dot. If the reply is stored in a variable called user, then user.location gives "San Francisco" and user.public_repos gives 8.

API examples you use every day

• Weather and travel apps fetch forecasts, train times and flight prices from other companies' APIs.
• "Sign in with Google" or Apple buttons use the provider's login API, so the app never sees your password.
• Maps on websites, like a shop's "find us" page, are drawn by a mapping company's API.
• Online payments go through a payment company's API, so the shop never stores your card details.
• AI chat inside other apps sends your message to an AI model's API and shows the reply.
• Your phone's camera, GPS and notifications are reached by apps through the operating system's APIs.

Types of API

By who can use them

• Public (open) APIs: any developer can sign up and use them, sometimes for free and sometimes for a fee.
• Partner APIs: shared only with chosen companies, such as a hotel chain sharing room prices with booking sites.
• Private (internal) APIs: used only inside one organisation, for example between a company's app and its own servers.

By style

• REST: the most common style for web APIs. Each thing has its own address (like /users/octocat), and the HTTP methods above act on it.
• GraphQL: one address, where the client writes a query saying exactly which properties it wants back.
• SOAP: an older, stricter style that sends messages in XML, still found in banking and government systems.
• Library and operating system APIs: not web services at all, but the functions a programming library or an operating system offers to programs.

What is API access?

API access means permission to use a service through its API, so your own software can talk to it directly rather than you clicking around its website. When a product says a plan "includes API access", it means developers on that plan can connect their own apps to it. Access usually comes with an API key or a login token, plus limits on how many calls you can make.

What is API testing in software?

API testing checks an API directly, by sending it requests and checking the responses, without going through an app's screens. Testers check that:

• the right data comes back, with the properties the documentation promises;
• the status codes are correct, including for bad requests such as a missing field;
• only allowed users can reach protected data;
• responses come back fast enough when many calls arrive at once.

Testers send requests by hand with tools such as curl or Postman, then write automated tests that run every time the code changes. Because an API has no buttons to click, these tests are quicker and more reliable than testing through a user interface.

APIs and AI

AI models reach other software through APIs too. When an AI assistant checks your calendar or searches a database, it is making API calls behind the scenes. MCP (Model Context Protocol) is a standard way to connect AI apps to these tools, and our MCP Servers course shows how it works.

Common mistakes

• Thinking an API is a website. A website is for people; an API is for programs. Many services have both.
• Thinking an API is the server or the database. It is the interface in front of them: the rules for asking.
• Thinking every API is on the web. Programming libraries and operating systems have APIs too.
• Calling every web API "REST". REST is one style. GraphQL and SOAP work differently.
• Using GET to change data. GET should only read; use POST, PUT, PATCH or DELETE to change things.

To build and call your own API step by step, the APIs course starts with requests and ends with you writing endpoints in Express and calling them with fetch.

Read next

Computer Science · Web and APIsWhat is an API key? Meaning, examples and keeping it safeWhat an API key is, how it works in a real request, how it differs from a token, how to get one for Gemini or OpenAI, and how to keep it safe.