An API (Application Programming Interface) is the mechanism that lets one piece of software talk to another. When you check the weather on your phone, pay for something online, or log into a new app using your Google account, an API is doing the work behind the scenes. It's one of the most fundamental concepts in modern technology, yet most people have never heard the term explained in plain English.
What an API actually does
The simplest way to understand an API is to think of a restaurant. You're the customer. The kitchen is the system that holds all the data or functionality you want. The waiter is the API. You don't walk into the kitchen and start cooking. You tell the waiter what you want, the waiter carries that request to the kitchen, and the kitchen sends back exactly what was ordered.
In software terms: your app sends a request to an API. The API delivers that request to a server or database. The server processes it and sends a response back through the API. Your app receives the response and shows you the result. The whole exchange can happen in under a second.
A concrete example helps. When you tap "Pay with PayPal" on a shopping site, that site doesn't store your PayPal details. It sends a request to PayPal's API, which handles the transaction on PayPal's own servers and returns a confirmation. The shopping site never sees your password or card number. That separation is one of the big reasons APIs matter.
Types of APIs you encounter every day
There are several kinds of APIs, but the one most people interact with indirectly is a REST API (Representational State Transfer). REST APIs use standard web protocols to send and receive data, typically formatted as JSON (a lightweight text structure that's easy for machines to read). They power most modern websites and mobile apps.
Other common types include:
- Web APIs: Connect services over the internet. Think Google Maps embedded in a restaurant booking site.
- Operating system APIs: Let apps talk to your device's hardware. When an app asks for your camera, it's using an OS API.
- Database APIs: Let applications query and update databases without developers needing to write raw database commands.
Most of what Australians interact with online runs on web APIs. The streaming service you used last night, the banking app you opened this morning, and the navigation app on your dashboard all rely on them.
Why APIs matter for privacy and security
APIs create a controlled boundary. Rather than giving a third-party app direct access to a database full of sensitive records, a company can expose only the specific data or functions the third party needs, through a carefully designed API. That limits what can go wrong.
Authentication is a key part of this. Most APIs require a secret key (called an API key) that identifies who is making the request. Without a valid key, the API refuses to respond. Some APIs add further layers, such as two-factor authentication requirements or rate limiting (capping how many requests a single user can make in a given period).
Poor API design is also a genuine threat vector. When an API exposes more data than it should, or fails to validate requests properly, attackers can exploit those gaps. This is why cybersecurity professionals treat API security as its own discipline. Several major data breaches in Australia over the past few years have traced back to insecure or misconfigured APIs.
How developers build and use APIs
Building an API means deciding what requests you'll accept, what data you'll return, and what rules govern access. A developer writing an API for a weather service might say: send us a city name, and we'll return the current temperature, humidity, and a 7-day forecast in JSON format. They document those rules so other developers know exactly how to use the API.
Consuming an API means writing code that sends the right requests and handles the responses. A developer building a travel app might call a flights API, a hotels API, and a currency conversion API all within a single page load. Each one returns a small package of data. The app stitches those together and presents them as a seamless interface.
This composability is what makes APIs so powerful. Instead of building every feature from scratch, developers can plug into existing services. Stripe handles payments. Twilio handles SMS. Mapbox handles maps. A small team can build a sophisticated product quickly by combining specialist APIs.
Public APIs vs private APIs
Not all APIs are available to everyone. Public APIs (sometimes called open APIs) are intentionally exposed so that third-party developers can build on top of a platform. X (formerly Twitter) and Spotify both publish public APIs that developers use to build client apps, analytics tools, and integrations.
Private APIs are internal. A large company might have hundreds of private APIs connecting its own services to each other, never exposed to the outside world. Partner APIs sit in between: shared with specific business partners under agreed terms, but not open to the public.
The distinction matters for businesses too. A company that publishes a well-designed public API can create an ecosystem of third-party products that extend its platform's value. The Stripe API is a widely cited example of this done well: clean, well-documented, and trusted by hundreds of thousands of businesses globally, including many in Australia.
What happens when an API breaks
API failures are more visible than people realise. When a major cloud provider goes down, apps that depend on its APIs go dark too. In 2021, a Facebook infrastructure outage took Instagram and WhatsApp offline because those services depended on internal APIs that couldn't reach Facebook's servers. The apps existed. The data existed. But nothing could communicate.
Versioning is how responsible API providers manage change. Rather than updating an API in a way that breaks existing apps, they release a new version (v2, v3) and keep the old one running while developers migrate. It's one of the less glamorous parts of software engineering. It's also one of the most important.
APIs aren't a niche developer concern. They're the connective tissue of the internet, and understanding what they do helps explain why so much of modern software behaves the way it does.