Lesson 4 of 6 · About 6 minutes
How applications communicate through APIs
Learn the concept.
An API is an interface that lets software ask other software to do something. Here we focus on an HTTP API: a web page requests structured data from a service.
Read a small API response
Fictional response for GET /api/books/42.
- Status200 OK
This operation succeeded.
- Content-Typeapplication/json
The body is structured JSON data.
- Body fieldtitle: Small Steps in Security
The interface can use this value as text.
Read the visualWhat can an HTTP API return for a web page to use?
A page can read fields from structured data and update its interface. APIs may use other formats too.
Identify the operation
An endpoint is an address for an API operation. GET /api/books/42 asks this fictional API for one book. Other operations may use methods such as POST and can change data.
Read the structured result
JSON represents values using named fields, arrays, and objects. A page can use a returned title field to update what you see. An API response does not have to be a complete HTML page.
Keep the security checks
APIs need the same care about authentication, authorization, and input as visible pages. A hard-to-guess address or an endpoint omitted from a menu is not protection.
Put it in context
Harbor Books returns {"id":42,"title":"Small Steps in Security"} as an example body. The browser displays the title. Requesting a different book changes the resource being requested, not the caller’s permission.
Make a decision.
Explore the practice space, then answer the check-in below. A correct answer lets you save this lesson to your progress.
YOUR PRACTICE SPACE
Try the idea for yourself.
Enable JavaScript to explore this fictional exercise. The explanation and visual above remain available.
Take this with you.
An API is another doorway to application behavior. Check the caller and the requested operation.
Next lesson: Logging in does not grant every permission