Home / Glossary / API (Application Programming Interface)
Tech & ITAPI (Application Programming Interface)
By Sitraka Forler · Lecturer, Durham Business SchoolUpdated 13 September 2026 About this site
The defined way one piece of software asks another for data or actions.
An API defines what a program offers and how to ask for it: the functions a library exposes, such as pandas.read_csv, or the web addresses (endpoints) a remote service answers. At work you pull market data or trigger internal systems through APIs, often with an API key kept out of your code. When someone says "the API is down", they mean the service behind it: the API itself is only the interface.
The intuition
An API, or application programming interface, is a contract for how one program asks another for something. It lists the operations on offer, what each needs as input and what it returns, while hiding how the work is done. Think of a restaurant menu: you order the risotto without entering the kitchen, and the kitchen can change its chef or its ovens as long as the risotto still arrives as described.
The word covers two everyday cases. A library API is the set of functions and classes a package exposes inside your own program: pandas.read_csv() is part of the pandas API. A web API works across a network using HTTP (Hypertext Transfer Protocol): your program sends a request (a method such as GET or POST, a URL called an endpoint, headers and sometimes a body) and receives a response with a status code, headers and usually a body in JSON (JavaScript Object Notation), a plain-text data format.
Because an API is a contract, each side can change its internals freely as long as the contract holds. That is why providers publish documentation, version their APIs, ask you to identify yourself with an API key or token, and enforce rate limits. When a job asks you to pull data from an API, it means reading that contract and sending requests that match it.
Example
import requests # a library: its functions are its API
resp = requests.get("https://api.github.com") # call GitHub's public web API
print(resp.status_code) # 200 means the request succeededAsk the GitHub REST API about a repository and read its answer
- Send one request from a terminal: curl -i https://api.github.com/repos/python/cpython. The -i flag prints the response headers as well as the body. Public data needs no key, although unauthenticated requests are rate limited.
- Read the status line first: it shows 200 (as HTTP/2 200, or HTTP/1.1 200 OK if your curl uses HTTP/1.1), meaning the request succeeded. Any 2xx code is a success, a 4xx code means your request was wrong, and a 5xx code means the server failed.
- Scan the headers: content-type: application/json; charset=utf-8 says the body is JSON, and x-ratelimit-remaining tells you how many more requests you can make before the limit resets.
- Read the body: a JSON object with fields such as "full_name": "python/cpython", "private": false and "default_branch": "main". The documentation for this endpoint describes every field.
- Do the same from Python (after pip install requests, then import requests): r = requests.get("https://api.github.com/repos/python/cpython", timeout=10). print(r.status_code) prints 200, and data = r.json() turns the body into a dictionary, so data["default_branch"] is "main".
- Break it on purpose: request https://api.github.com/repos/python/no-such-repo instead. The status is 404 and the body is still JSON, with "message": "Not Found", which is why you check r.status_code (or call r.raise_for_status()) before trusting the data.
Every web API call has the same shape: send a request, check the status code, then parse the body, with the documentation as the contract that says what each field means.
Common pitfalls
- Trusting the body without checking the status code: Python's requests does not raise an error on a 404 or a 500, so code can happily parse an error message as if it were data. Check r.status_code or call r.raise_for_status() first.
- Leaving out a timeout: without one, requests can wait indefinitely for a server that never answers, freezing a script or a scheduled job. Pass timeout= on every call.
- Putting API keys in code or in URLs: keys committed to Git or pasted into query strings end up in history and server logs. Load them from environment variables and send them the way the documentation specifies, usually in a header.
- Hammering an API in a tight loop: providers enforce rate limits, and going over usually returns 429 Too Many Requests (GitHub may answer 403 or 429). Read the rate-limit headers, pause between calls and back off when told to.
- Relying on undocumented fields or endpoints: only the documented contract is promised, so anything else can change or disappear without notice and break a pipeline overnight.
Frequently asked questions
What is an API in simple terms?
An API (application programming interface) is a set of rules that lets one program request data or actions from another without knowing how it works inside. Like a restaurant menu, it lists what you can order and what you will get back, while the kitchen stays hidden. Weather apps, payment pages and data pipelines all rely on APIs.
What is the difference between a library API and a web API?
A library API is the set of functions a package exposes inside your own program, such as pandas.read_csv, and the work runs on your machine. A web API is reached over a network with HTTP requests to URLs called endpoints; the work runs on someone else's server, which replies with a status code and usually JSON.
What is a REST API?
A REST (Representational State Transfer) API is a web API organised around resources, each identified by a URL, that you act on with standard HTTP methods: GET to read, POST to create, PUT or PATCH to update and DELETE to remove. Responses carry a status code and usually a JSON body. It is the style of web API you are most likely to meet at work.
What is an API key?
An API key is a secret string that identifies your application to an API, so the provider can check permissions, apply rate limits and bill usage. Treat it like a password: keep it out of code and out of Git, load it from an environment variable, and rotate it straight away if it leaks.
How can I test an API without writing a program?
Use curl in a terminal, for example curl -i https://api.github.com, which prints the status line, headers and body of the response. Graphical tools such as Postman do the same through forms, and many APIs publish interactive documentation that lets you send test requests from the browser.