News

Jan 28, 2024

What APIs Do and Don’t Do

It’s hard to be in the realm of technology and not hear about APIs these days.

It's hard to be in the realm of technology and not hear about APIs these days. Whether it's the launch of the ChatGPT API or news of a significant data breach at Twitter, APIs are having their time in the spotlight.

Yet, despite their ubiquity, many still have questions about APIs' capabilities (and limitations). What are APIs for? What do they do? And what are they unable to do in the current era?

An API is an Application Programming Interface - a small piece of software designed for communication. An API serves as a messenger between an end user and a website or application.

That may sound simple, but APIs are powerful and vital tools. Without an API, a site, app, or service is relatively segregated and highly limited in functionality. APIs define and perform functionalities that a site or app cannot achieve independently.

Imagine this scenario: you enter a restaurant and sit at a table. You look at the menu and decide what you’d like to order. A waiter approaches, takes your order and any special requests, and then goes to pass that information to the kitchen so that your food can be prepared. Once your meal has been cooked, the waiter returns to your table to deliver it.

In this illustrative example, the waiter is your API. Without it, you would be stuck at the table, staring at your menu, imagining the menu you would enjoy if only the chef knew what you wanted.

That example helps lend context to APIs, so you can imagine them as messengers helping to fulfill your needs. In real-world terms, what do APIs do? Let's look at some essential API functions:

A common approach to account creation on websites is to use one of your existing accounts - often a Google or Facebook account - instead of creating a new one. An API is at work when you enter a website and can use another account to authenticate. The API bridges the two platforms to confirm your identity and save the hassle of remembering another password.

The security of private data is front of mind for many people, including payment and financial data. For many, inputting card and payment details into various websites may feel risky. After all, security breaches are on the rise.

A PayPal API lets eCommerce shoppers use their existing PayPal account to complete a transaction on a third-party website. This API integration facilitates the payment and ensures that the online store does not have any personal payment information to receive the funds, release the product, or provide services.

If you’re planning a vacation and need to book a hotel, airfare, or rental car, you’ve used more than one API without knowing it. APIs connect the third-party portal - such as Booking.com or Expedia, for example - to providers like airlines, rental agencies, and hotels. Through these APIs, they provide real-time information on availability and pricing. APIs will also transmit your booking details to the respective providers to confirm your details and ensure someone else can't book your same seat, room, or car.

When you open your favorite maps app to get directions, APIs are helping you make the most of the interface. APIs communicate with data providers to get real-time information on traffic and road closures. You may also see an alert that certain areas of your city are "busier than normal," the work of an API understanding that others with their GPS enabled are gathered in that area. APIs are also responsible for business hours, reviews, and other pertinent info on local businesses.

The maps API can also be integrated into websites or emails. If you’ve ever clicked on a business address and had Google Maps open in your browser or the app, you’ve used the Google Maps API.

Want to know about more APIs that are powering modern life and business? Have a look at this list of some of the best APIs.

APIs seem to do it all, don't they? While it's true that these silent heroes are working tirelessly to power so many functions we often take for granted; they can't do everything.

An API can facilitate a connection between a business and a customer, but it cannot address any issues that arise. APIs are simply messengers, not problem-solvers. An API may be useful for collecting feedback, offering things like chatbots to field questions, and bridging the gap between customer and provider. Yet, an API will be unable to act on the feedback - good or bad - without further intervention.

Similarly, an API is not AI. While APIs can help gather information, they won't parse it for you or make an action plan. When devising solutions and taking action, you’ll still need a business process to make those decisions.

One mistake to avoid is thinking that an API will solve any system issues. An API is a supplement to a well-oiled machine, not a patch fix to cover up any glaring problems. Build a robust and functional system first, then avail an API to enhance the offering.

APIs are vital to performing tasks and doing business in the modern world. Yet, their popularity among businesses and end users has not gone unnoticed by bad actors. API security incidents are on the rise. According to a recent survey:

"94% had some security issue with their production APIs over the past year, with vulnerabilities topping the list at 41%, followed closely by authentication problems at 40%. Of more concern, 31% had experienced a sensitive data exposure or privacy incident and 17% had experienced a security breach; such events have significant costs and reputational damage associated with them."

APIs must be developed and implemented with care to avoid security pitfalls.

Stefanie Shank. Having spent her career in various capacities and industries under the "high tech" umbrella, Stefanie is passionate about the trends, challenges, solutions, and stories of existing and emerging technologies. A storyteller at heart, she considers herself one of the lucky ones: someone who gets to make a living doing what she loves. Stefanie is a regular writer at Bora.

Editor's Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire.