# What Is an API? Meaning, Types, and Examples

> An API is a contract that lets two applications exchange data. Learn how APIs work, REST to GraphQL types, real examples, and API security basics.

**URL:** https://www.ciptadusa.com/blog/api-adalah  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Engineering  
**Published:** 2026-10-28  
**Cover:** https://www.ciptadusa.com/media/uploads/blog/2026-10/1793158640696-api-adalah-20261028.webp  

## Article

An API, short for Application Programming Interface, is a contract that lets one piece of software access data or invoke functions exposed by another. AWS defines it as a mechanism that enables two software components to communicate with each other using a set of definitions and protocols ([source](https://aws.amazon.com/what-is/api/)). IBM adds that an API exposes only the data and functionality needed for a specific interaction, while other internal implementation details stay hidden ([source](https://www.ibm.com/think/topics/api)).

This article covers what an API is, how it works, the main types, business examples, how it differs from webhooks and middleware, API security, and what to prepare before you build or integrate an API.

## What Is an API?

According to AWS, the word "application" in API refers to any software with a distinct function, while "interface" can be thought of as a service contract between two applications. That contract defines how the two communicate through requests and responses, and the API documentation tells developers how to structure both ([source](https://aws.amazon.com/what-is/api/)).

A simple analogy (a CDS simplification): an API works like a menu and a waiter in a restaurant. The customer never walks into the kitchen. They order from the menu, the waiter takes the order to the kitchen and comes back with the food. The menu is the contract, and the kitchen is the internal system the customer does not need to see.

AWS gives a weather example: a weather bureau's software system holds daily weather data, and the weather app on your phone talks to that system through an API to show you daily updates ([source](https://aws.amazon.com/what-is/api/)).

### What API Stands For

| Term | Meaning |
| --- | --- |
| Application | Software with a specific function, such as an online store, a warehouse system, or a payment service |
| Programming | Communication happens between programs (code), not between people clicking buttons |
| Interface | The meeting point defined by rules: what data can be requested, in what format, and what response comes back |

IBM lists many classes of APIs: hardware and firmware APIs, operating system APIs, library and framework APIs, database APIs, and web APIs. In everyday conversation, API is used as a synonym for web API, meaning an API that receives requests over a network, commonly over HTTP ([source](https://www.ibm.com/think/topics/api)). This article focuses on web APIs because they are the ones that connect business applications.

## How an API Works

AWS describes API architecture in terms of client and server. The application sending the request is the client, and the application sending the response is the server ([source](https://aws.amazon.com/what-is/api/)). For a web API, the flow looks like this:

1. The client (a web app, mobile app, or another system) sends a request to a specific address called an endpoint.
2. The request contains an HTTP method, headers (for example an access token), and sometimes a body with data.
3. The server checks that the request is valid and that the client has permission.
4. The server runs the business logic, such as reading the database or creating an order.
5. The server returns a response with a status code and data, and the client shows it to the user.

IBM uses the example of a "Pay with PayPal" button on an online store: when the buyer clicks it, an API call goes to the third-party payment system, and the result is returned to the store's website. To the user, the whole exchange is invisible; they only see a successful payment confirmation ([source](https://www.ibm.com/think/topics/api)).

### Example Request and Response

Here is an illustrative request to fetch a single customer from a REST API (the endpoint and data are examples):

```http
GET /api/v1/customers/1024 HTTP/1.1
Host: api.example-store.com
Authorization: Bearer <access-token>
Accept: application/json
```

The server's response:

```json
{
  "id": 1024,
  "name": "Sumber Rejeki Store",
  "city": "Bandung",
  "status": "active"
}
```

The client does not know which database the server uses, how its tables are laid out, or which programming language runs it. It only needs to know the contract: send a GET to this endpoint with a valid token, and receive the data as JSON.

### HTTP Methods and Status Codes

MDN documents the HTTP request methods that REST APIs use to express an action on a resource ([source](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods)):

| Method | What it does (per MDN) | Business app example |
| --- | --- | --- |
| GET | Requests a representation of a resource; only retrieves data | Fetch the product list |
| POST | Submits data to a resource, which can change state on the server | Create a new order |
| PUT | Replaces the whole representation of a resource with the request content | Replace a customer's address record |
| PATCH | Applies partial modifications to a resource | Update only the order status |
| DELETE | Deletes a resource | Delete a draft quotation |

The server answers with a status code. MDN groups them into five classes: 100–199 informational responses, 200–299 successful responses, 300–399 redirection messages, 400–499 client error responses, and 500–599 server error responses ([source](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status)). For example, 404 means the resource was not found and 401 means the client is not authenticated.

## Types of APIs

APIs can be grouped in two ways: by architectural style (how they communicate) and by access (who is allowed to use them).

### By Architecture and Protocol

| Type | Key traits | Good fit for |
| --- | --- | --- |
| REST | Data is treated as resources with unique URIs, uses HTTP methods, stateless | Web APIs and mobile apps |
| SOAP | XML-based messaging protocol with strict standards; can run over HTTP, SMTP, and other protocols | Enterprise systems that need formal standards, such as finance and healthcare |
| RPC (including JSON-RPC and gRPC) | Action-oriented; the client calls a function on the server as if it were local | Internal service-to-service communication |
| GraphQL | The client specifies exactly which data it wants through a single endpoint | Apps with widely varying client data needs |
| WebSocket | A persistent, two-way connection | Real-time features such as chat or live data |

Sources for the table: IBM ([source](https://www.ibm.com/think/topics/api)) and AWS ([source](https://aws.amazon.com/what-is/api/)).

REST itself is an architectural style that Roy Fielding defined in his doctoral dissertation at the University of California, Irvine in 2000 ([source](https://ics.uci.edu/~fielding/pubs/dissertation/top.htm)). IBM summarizes its six constraints: uniform interface, client/server separation, statelessness, cacheability, layered system architecture, and the optional code on demand ([source](https://www.ibm.com/think/topics/api)).

According to IBM, gRPC was initially developed by Google, uses the binary Protocol Buffers format, and runs over HTTP/2, while GraphQL was developed by Facebook in 2012 ([source](https://www.ibm.com/think/topics/api)).

### By Access

AWS and IBM classify APIs by scope of use ([source](https://aws.amazon.com/what-is/api/)):

- Private (internal) APIs: used only inside a company to connect internal systems and data.
- Public APIs: open to any developer; some require an API key or charge a fee.
- Partner APIs: accessible only to authorized partners, for example for B2B data sharing.
- Composite APIs: combine several API calls to handle one requirement. IBM considers them better understood as an architectural pattern than an access level ([source](https://www.ibm.com/think/topics/api)).

## API Functions and Business Benefits

AWS lists four benefits of REST APIs: integrating new applications with existing systems without writing every function from scratch, innovating through changes at the API level without rewriting all the code, expanding across platforms, and easier maintenance because internal changes in one system do not have to affect the other ([source](https://aws.amazon.com/what-is/api/)).

In day-to-day business terms, those benefits look like this:

- One backend, many channels. IBM notes that an organization can build backend functionality once and serve web, iOS, and Android clients through APIs, adding new channels without rebuilding the backend ([source](https://www.ibm.com/think/topics/api)).
- Data kept in sync across systems. IBM's example: when a customer address is updated in the CRM, the change can be propagated automatically to connected systems, including the ERP ([source](https://www.ibm.com/think/topics/api)).
- Third-party services plugged in. Payments, maps, shipping, and AI models can be added through APIs instead of being built in-house.
- Data shared with partners under control. A logistics company, for example, can expose order tracking through an API so retailers can show it in their own systems ([source](https://www.ibm.com/think/topics/api)).

## API Examples in Everyday Life and Business

| Situation | What the API does |
| --- | --- |
| Weather app on a phone | Fetches weather data from the data provider's server, as in AWS's example |
| Pay button on an online store | Sends transaction data to the payment provider and receives the payment status |
| Store locator map on a website | Displays a map from a third-party mapping service |
| Sales dashboard | Pulls order data from a point-of-sale app or marketplace into one report |
| CRM and ERP | Syncs customer, order, and invoice data between systems |
| AI agent | Calls an API or MCP server to read and update business data |

Illustration (a fictional example): a distributor in West Java records sales orders in its CRM, while stock and invoices live in its ERP. Without an API, an admin copies each order into the ERP by hand. With an API, the CRM sends a POST to the ERP's order endpoint as soon as an order is approved, and the ERP returns an invoice number that is saved back in the CRM. For background on both systems, read [what is CRM](/en/blog/crm-adalah) and [what is ERP](/en/blog/erp-adalah).

## API vs Webhook vs Middleware vs Backend

| Term | Core idea | Who starts the communication |
| --- | --- | --- |
| API | A contract defining what can be requested and what is returned | The client sends a request |
| Webhook | An automatic notification sent when a specific event happens | The provider's server sends data to the receiver's URL |
| Middleware | An intermediary layer that runs, forwards, or manages communication | Depends on the type |
| Backend | The server side of an application that stores data and runs business logic | Exposes APIs for clients |

IBM explains that webhooks invert the request/response model: instead of the client asking for data, the server pushes a notification to the client when a specified event occurs ([source](https://www.ibm.com/think/topics/api)). For more detail, see [what is middleware](/en/blog/middleware-adalah), [what is a backend](/en/blog/backend-adalah), and [what is a frontend](/en/blog/frontend-adalah). How APIs, webhooks, and ETL fit together across systems is covered in [what is system integration](/en/blog/integrasi-sistem-adalah).

### API Gateway

IBM defines an API gateway as a software layer that presents a single entry point for clients to reach multiple backend services, with key functions including routing, authentication, rate limiting, and monitoring ([source](https://www.ibm.com/think/topics/api)). An API gateway is one example of middleware.

## API Security

An API endpoint is a doorway into business data, so its security needs to be designed from the start. AWS describes two basic ways to secure a REST API: authentication tokens, which confirm that users are who they claim to be and have access rights, and API keys, which identify the calling application. AWS also notes that API keys are not as secure as tokens ([source](https://aws.amazon.com/what-is/api/)).

OWASP publishes the OWASP Top 10 API Security Risks 2023. Its top three risks are ([source](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)):

1. API1:2023 Broken Object Level Authorization: an endpoint accepts an object ID from the user without checking whether that user is allowed to access the object.
2. API2:2023 Broken Authentication: authentication mechanisms implemented incorrectly, letting attackers assume other users' identities.
3. API3:2023 Broken Object Property Level Authorization: missing authorization checks at the object property level, leading to data exposure or manipulation.

The same list includes unrestricted resource consumption (API4), which can lead to denial of service or higher operating costs, and unsafe consumption of third-party APIs (API10) ([source](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)). For Next.js apps, security and deployment practices are covered in [Next.js security and deployment](/en/blog/nextjs-security-deployment).

## How to Build or Integrate an API

AWS outlines five steps for producing a high-quality API design: plan it with a specification such as OpenAPI, build a prototype, test it, document it, and market it if the API is meant for outside developers ([source](https://aws.amazon.com/what-is/api/)). The OpenAPI Specification is a standard for describing HTTP APIs maintained by the OpenAPI Initiative ([source](https://www.openapis.org/)).

The checklist below is an internal CDS guide we use before starting an API or integration project:

- Define the data and actions you actually need. Do not expose an entire database table just because it is easy.
- Write the contract first: the list of endpoints, request and response formats, and error codes.
- Choose authentication and authorization: who can read, who can change, and check permissions on every object.
- Plan API versioning (for example /v1) so major changes do not break running integrations.
- Set request limits, logging, and monitoring from the first release.
- Test the integration with real data before go-live, including failure scenarios. Testing with end users is covered in [what is UAT](/en/blog/uat-adalah).
- Budget for maintenance: third-party APIs change versions, and integrations need monitoring. See [application maintenance costs](/en/blog/biaya-maintenance-aplikasi).

### APIs and AI Agents

IBM notes that AI agents also use APIs to reach services, and that the Model Context Protocol (MCP) is an open standard that sits on top of existing APIs so agents can discover and use tools in a consistent way ([source](https://www.ibm.com/think/topics/api)). One example is [Zetta CRM](/en/incubating/zetta-crm), a CDS incubating product: a Go-based MCP server for AI agents with a POST /mcp endpoint and API-key gated access. The architecture is discussed in [MCP server as an AI agent backend](/en/blog/mcp-server-backend-ai-agent-aman-bisnis).

## API FAQ

### What is an API in simple terms?

An API is a set of rules that lets two applications exchange data. One application sends a request in an agreed format, and the other answers with data or a result, without exposing its internal system.

### What does API stand for?

API stands for Application Programming Interface ([source](https://aws.amazon.com/what-is/api/)).

### What are everyday examples of APIs?

A weather app fetching data from a provider's server, a payment button on an online store, a map on a website, and signing in with a third-party account. Each of them uses an API to request data or a service from another system.

### What is a REST API?

A REST API follows the REST architectural style: data is treated as resources with unique addresses, accessed through HTTP methods such as GET and POST, and the server does not store client state between requests ([source](https://aws.amazon.com/what-is/api/)).

### What is the difference between an API and a webhook?

With an API, the client starts the request. With a webhook, the provider's system sends a notification to the receiver's URL as soon as an event happens ([source](https://www.ibm.com/think/topics/api)). Business integrations can use both together.

### Are APIs secure?

An API is secure when it is designed with authentication, per-object authorization, encryption, input validation, and request limits. The OWASP API Security Top 10 2023 works well as a risk checklist ([source](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)).

## Need an API or Integration for Your Business Systems?

If your point-of-sale app, CRM, ERP, or marketplace accounts are not connected yet, the CDS team can help design the API contract, build the backend, and integrate your existing systems. Our [custom software development](/en/services/software) service covers web and mobile apps, internal dashboards, CMS, and API integration, delivered in two-week sprints with full code handover. If the architecture is still unclear, start with [IT architecture consulting](/en/services/consulting), or browse [our work](/en/works) first.


---

*Markdown version of https://www.ciptadusa.com/blog/api-adalah — generated for AI agents and LLM crawlers.*