In short
An API (application programming interface) is a clearly defined set of rules through which two software systems communicate with each other. It specifies which requests a system may make, what format these requests must take and which response comes back.
The decisive point: the requesting system does not need to know how the other one works internally. It only knows the contract, the API. It is precisely this decoupling that makes APIs the backbone of modern software.
A common metaphor is the menu in a restaurant. You order from a fixed list without entering the kitchen or knowing how the food is cooked. The menu is the interface between you (the requesting system) and the kitchen (the responding system). You say what you want and get a defined result back. The API is this menu for software.
How an API works
On the web, communication almost always takes place via the HTTP protocol. A client (such as an app or an online shop) sends a request to a specific address (endpoint) on a server. The server processes the request and sends back a response, usually in the JSON data format. A typical request consists of a method (for example GET to retrieve, POST to create), the target URL and often an authentication key that proves the client is authorised to access it.
An example: a weather app on your phone has no weather data of its own. It calls a weather service via an API ("give me the forecast for Mönchengladbach") and gets structured data back, which it then presents nicely. The app and the weather service are two completely separate systems that only work together via the API.
REST and GraphQL: the two most common styles
Not every API is built the same way. On the web, two approaches with different strengths have become established.
| Feature | REST | GraphQL |
|---|---|---|
| Data retrieval | Fixed endpoints, one per resource | One endpoint, the client describes the fields it wants |
| Amount of data | Often delivers more or less than needed | Delivers exactly the requested fields |
| Maturity | Very widespread, easy to cache | Younger, flexible, somewhat more complex to set up |
| Typical use | Classic web services, public APIs | Complex front ends with many data sources |
REST (representational state transfer) organises the API around resources, each of which can be reached under its own URL, such as /products or /orders/42. It is robust, widespread and easy to cache. GraphQL turns the principle around: there is a single endpoint, and in the request the client describes exactly which fields it needs. This avoids the classic REST problem of getting either too much data (overfetching) or too little (underfetching). Which style fits depends on the use case, not on fashion.
Why APIs are so important for companies
No serious software product stands alone today. An online shop talks to the payment service provider, the shipping service, the merchandise management system and the newsletter tool. Each of these connections is an API integration. APIs are therefore the building blocks from which digital business processes are put together. Three reasons make them so central:
- Reusability: an API, once built, can be used by many different applications (web shop, mobile app, partner systems) without the logic being recreated each time.
- Specialisation: you do not have to build everything yourself. You connect payment processing, map services, AI models or shipping labels as a ready-made service via API instead of reinventing the wheel.
- Scalability: clearly delimited interfaces make it possible to operate, replace and scale individual parts of the system independently, the basis of modern, modular architectures.
A concrete example from e-commerce
A Shopware shop sells products that are stored in the warehouse of an external logistics provider. When a customer orders, the following happens via APIs: the shop calls the payment service provider's payment API to authorise the payment. Once it is confirmed, the shop sends a shipping instruction to the warehouse via API. Via a webhook (an API that becomes active of its own accord as soon as an event occurs), the warehouse system reports back as soon as the parcel has left the building, including the tracking number. The shop then updates the order status and informs the customer. Four systems that do not know each other work together smoothly, exclusively via APIs.
Building exactly this interplay cleanly is more demanding than it sounds. Badly documented interfaces, missing error handling or insecure authentication are the most common causes of outages in networked systems. A well thought-out API integration therefore plans from the outset for what happens when a partner system does not respond.
API-first as an architectural principle
An increasingly widespread approach is "API-first". Here the interface is not tacked onto a finished system afterwards but designed from the start as the central product. The API is at the centre, and all interfaces (web, app, partner integrations) are merely consumers of this one, well-designed interface. Modern commerce systems such as Shopware 6 are consistently built API-first, which among other things makes them headless-capable. The advantage: new channels can be connected without touching the core logic.
Security and authentication
Because APIs open doors into a system, they have to be secured. Common measures are API keys (tokens) that legitimise every call and standards such as OAuth 2.0 for delegated access. In addition there are rate limits, which prevent a single client from overloading the service with too many requests, and clean rights management, which specifies who may see and change which data. Anyone who provides an API publicly should follow established standards; the OWASP API Security Project provides a good overview of secure API practices.
In summary
An API is the contractually defined interface through which software talks to software. It hides the inner complexity of a system behind a clear, stable façade and thereby makes it usable, combinable and extensible. For companies, APIs are not a technical detail but the basis for online shops, apps, AI services and business systems being able to connect into a functioning whole at all. Anyone who wants to grow digitally will sooner or later build on well-designed interfaces, and the quality of these APIs decides how smoothly that growth proceeds.