PrimLagic
What is an API? A plain-language introduction
API stands for Application Programming Interface: a defined way for one program to ask another program to do something. The classic example is a restaurant. You (the client app) give your order to the waiter (the API); the kitchen (the server) does the work. You never need to know what happens inside the kitchen.
Web APIs in practice
Most APIs you'll touch work over HTTP: the program sends a request and the server returns a response. From ClassBan, the school software I built: the students page sends
GET /api/students
and the server answers with a JSON list:
[
{ "id": 1, "firstName": "Ali", "lastName": "Ahmadi", "grade": "10 - Math" }
]
HTTP methods
Every request carries a "verb" saying what you want:
- GET: read data.
- POST: create something new.
- PUT or PATCH: update.
- DELETE: remove.
In the same software, POST /api/absences records a new absence and DELETE /api/absences/5 removes absence number 5.
Status codes
The response always carries a number that summarizes the result:
| Code | Meaning |
|---|---|
| 200 | OK |
| 201 | Created |
| 400 | Bad request |
| 401 | Not authenticated (log in first) |
| 403 | Forbidden |
| 404 | Not found |
| 500 | Server error |
What is JSON?
A simple text format for representing data: keys and values, lists and combinations of them. It is readable for humans and processable for programs.
Authentication and API keys
Most APIs want to know who you are. Common methods: an API key (a special string you send along with the request) or a token you receive after logging in. The important security rule: never put an API key in front-end code or a public repository — anyone who opens the page sees it. Keys belong on the server, in environment variables (the .env file).
Try it without writing code
You can test a public API from your browser (for GET requests), or with tools like curl and API testing apps:
curl https://example.com/api/items
What to always check
The status code, the error message shape (so your UI can react), rate limits, and whether the data you send is validated server-side — the client is never trusted.