API Glossary

Application Programming Interface. A set of rules that allows different software applications to communicate with each other. Think of it as a waiter in a restaurant: you (the app) tell the waiter (the API) what you want, and they bring it from the kitchen (the server).

A specific URL where an API can be accessed. Each endpoint represents a different resource or action. Think of endpoints like different departments in a store.

Representational State Transfer. The most popular API design style. REST APIs use standard HTTP methods (GET, POST, PUT, DELETE) and return data — usually in JSON format. Almost every public API listed in this directory is a REST API.

A unique string that identifies your application when making API requests. You get one by signing up on the API provider's website. It's like a hotel key card — it grants you access and tracks your usage.

The maximum number of API requests you can make in a given time period. If you exceed it, you get a 429 error. Free tiers typically have lower limits than paid plans.

JavaScript Object Notation. The most common format for API responses. It stores data as key-value pairs, arrays, and nested objects. It's human-readable and easy to parse in any programming language.

The type of action you want to perform on an API. GET retrieves data (safe, no side effects). POST creates new data. PUT/PATCH updates existing data. DELETE removes data. Most public APIs for reading data only use GET.

A three-digit number in every API response that tells you whether the request succeeded or why it failed. 200 = success. 400 = bad request (your mistake). 401 = unauthorized (wrong API key). 404 = not found. 429 = rate limited. 500 = server error.

Cross-Origin Resource Sharing. A browser security policy that controls whether JavaScript on one website can call APIs on a different domain. If an API has CORS enabled, you can call it directly from browser JavaScript. If not, you'll need a backend server.

An authorization protocol that lets users grant your app access to their account on another service without sharing their password. More complex to implement than API keys, but required by social platforms like Twitter, Google, and GitHub.

Extra information sent along with your API request, separate from the URL. Headers commonly carry your API key (Authorization), the data format you expect (Accept: application/json), or the content type you're sending.

Extra options added to the end of an API URL after a '?' to filter, sort, or customize the response. Multiple parameters are separated by '&'. They're the most beginner-friendly way to pass data to an API.

A way for an API to automatically send data TO your server when something happens, instead of you constantly asking for updates. You give the API your server's URL, and it calls it when an event occurs. Like a notification system.

Software Development Kit. A pre-built library for a specific programming language that makes using an API much easier. Instead of writing raw HTTP requests, you use simple function calls. Many popular APIs have official SDKs for JavaScript, Python, and more.

When an API has too many results to return at once, it splits them into pages. You request one page at a time using parameters like page, limit, or offset. Always check if an API paginates when you expect more results than you're getting.

The process of proving who you are to an API so it knows the request comes from a legitimate account. Common methods include API keys, bearer tokens, and OAuth. Authentication answers the question "who are you?" — as distinct from authorization, which decides what you're allowed to do.

The process of deciding what an authenticated user or app is permitted to do. Once an API knows who you are (authentication), authorization determines which resources and actions you can access — for example, read-only versus write access. A failed authorization typically returns a 403 Forbidden status code.

A string of characters an API issues to represent a granted session or set of permissions, sent with each request to prove access. Unlike a static API key, tokens are often short-lived and can be refreshed or revoked. Bearer tokens, commonly obtained through OAuth, are passed in the Authorization request header.

The message your app sends to an API to ask for data or trigger an action. A request combines an HTTP method (GET, POST, etc.), an endpoint URL, optional headers, and sometimes a body of data. The API processes it and sends back a response.

The message an API sends back after receiving your request. A response includes a status code indicating success or failure, headers with metadata, and usually a body containing the requested data — most often formatted as JSON.

Uniform Resource Locator. The web address that identifies where an API resource lives. An API URL combines the base domain, a path to a specific endpoint, and optional query parameters. Every API request is sent to a URL.

Writing code that anticipates and gracefully responds to failed API requests instead of crashing. Good error handling checks the response status code, reads any error message the API returns, and decides whether to retry, fall back, or alert the user. It's essential because networks fail and APIs return errors like 401, 404, and 429.