Also known as: Application Programming Interface · REST API · endpoint
An API (application programming interface) is a defined contract through which one piece of software provides functionality or data to another, specifying available operations, expected inputs, and returned outputs.
Public APIs are effectively permanent commitments. Once external consumers depend on a behaviour, changing it breaks them, which is why versioning strategy and deprecation policy matter more than initial design elegance.
APIs are now the primary attack surface of most applications. Broken object-level authorisation — where an endpoint checks that a caller is authenticated but not that they are entitled to the specific record requested — remains among the most common and most exploited web vulnerabilities.
REST
REST (Representational State Transfer) is an architectural style for networked applications in which resources are identified by URLs and manipulated through standard HTTP methods, with each request carrying all context needed to process it.
Idempotency
An operation is idempotent if performing it multiple times produces the same result as performing it once, which allows a client to safely retry a request without risking duplicate side effects.
Rate Limiting
Rate limiting restricts how many requests a client may make within a time window, protecting a service from overload, abuse, and runaway costs while ensuring capacity remains available to other users.
Principle of Least Privilege
The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.
Webhook
A webhook is an HTTP request sent automatically from one system to another when an event occurs, allowing the receiver to react immediately rather than repeatedly polling for changes.