APIs and Digital Platforms at Awareness Level

Learning objectives#

Expand API; explain requests, responses, endpoints and permissions; recognize why applications integrate services; distinguish an API from a GUI or website; and identify common errors and safeguards without programming depth.

What is an API?#

API stands for Application Programming Interface. It is an interface made available by software to let another piece of software request defined capabilities or exchange data. A user-facing GUI (graphical user interface) is designed for people to operate; an API is commonly designed for software-to-software use. Some applications offer both.

A useful analogy is a restaurant's ordering counter: the customer places a permitted request through a known interface, the system processes it and returns a result or error. The analogy shows separation of roles; it is not a literal technical specification. An API does not automatically grant access to every internal database field or make communication secure without other controls.

Client, server, endpoint and response#

Suppose a hypothetical approved banking app needs current service-branch details. Instead of storing every branch change in the app, it can call an organizational service through an API. The app acts as a client; the service receives the request and returns only information that the caller is permitted to obtain.

• Request: Message asking for data or an action, often including parameters.
• Endpoint: Named address/location or callable operation exposed by the API.
• Response: Returned result, status or error information.
• Authentication: Process of establishing the calling user's/system's identity or credentials.
• Authorization: Decision about what the caller may access or do.
• API key/token: Common mechanisms used in some APIs to identify applications or carry authorization information; keys/tokens must be protected and are not universal to every API.

A typical web API often communicates using HTTP and structured payloads such as JSON (JavaScript Object Notation). JSON is a text data format commonly used to represent objects and arrays; it is not a database or an encryption algorithm.

A tiny request/response example#

This is a fictional teaching example—not a real bank endpoint or a callable service:

Client request: GET /api/branches?city=Jaipur
Server response: Status 200 OK
Response data: {"city":"Jaipur","branches":["Central","North"]}

GET is a common HTTP method used to request a representation of a resource. The response contains structured data that the app can display. Other common methods include POST (often submit/create), PUT (often replace a resource), PATCH (often partially update), and DELETE (request deletion), although exact semantics depend on the API contract. A GET call does not mean the response is trusted or authorized; it still needs appropriate validation and access controls.

Recognize familiar HTTP status categories:

An HTTP status code reports how the API interaction was handled, not whether external financial facts are correct. The meanings are general; exact handling is contract-specific.

APIs, platforms and integration#

A digital platform provides an environment that connects users, developers, applications, sellers, buyers or other participants so they can interact or build services. Not every app or single-purpose website is necessarily described as a platform. APIs often help platforms expose supported features to other applications.

Banking-related examples (conceptual, not endorsements): a support application requests a permitted branch directory; a payment-service integration exchanges a transaction status; an internal reporting service supplies authorized aggregate totals. Integration can reduce duplicate manual entry, but correctness depends on data quality, authorization and careful exception handling.

A webhook is a notification mechanism by which one service contacts another when an event occurs, if configured. An API client may poll repeatedly for status; a webhook can instead deliver an event-driven notification. Neither guarantees that notifications can never be delayed or repeated. Implementations must handle duplicates and verification appropriately.

Security, reliability and privacy essentials#

Do not expose secret API keys in public pages or unrestricted client code. Use trusted connections, appropriate authentication and authorization, input validation, minimal permissions and logged/reviewable transactions where required. APIs can return error responses or time out; connected systems should not assume every response arrives instantly or exactly once.

API ≠ app screen: An API is a programmatic contract; a GUI is a human-facing interface. API ≠ Internet: Some APIs operate locally without web networking. API ≠ website URL alone: An endpoint needs specified methods, parameters, behavior and access rules. API integration ≠ sharing unlimited customer information: Data access should be appropriate and controlled.

Important terms and objective-exam facts#

Quick revision#

1. APIs let software systems interact through defined interfaces.
2. Client → request → endpoint/service → response is a basic web API flow.
3. GUI serves human users; API serves programmatic consumers.
4. JSON structures data; status codes indicate request outcomes.
5. Integration requires access control, error handling and privacy safeguards.

Practice questions — CA-10-06#

1. What does API stand for?
A. Application Programming Interface
B. Automated Payment Identifier
C. Application Personal Internet
D. Access Point Interface

2. In a typical web API exchange, the app sending a request is the:
A. Hypervisor
B. Physical sensor only
C. Client
D. Primary key

3. What is an API endpoint?
A. A printed bank QR code
B. A malware family
C. A physical desk terminal only
D. A designated operation/address offered by a service

4. Which format is often used to exchange structured data in web APIs?
A. JSON
B. NFC
C. RAM
D. HDMI

5. Which HTTP method is commonly used to request a resource representation?
A. PATCH exclusively
B. DELETE
C. FORMAT
D. GET

6. Which status code generally indicates a requested resource was not found?
A. 200
B. 404
C. 201
D. 500

7. An API returns HTTP 401. Which explanation is usually the closest?
A. Authentication is required or credentials are missing/invalid
B. Everything was successfully created
C. The resource certainly exists and is public
D. The client finished a backup

8. What is the difference between authentication and authorization in API access?
A. Both mean screen size
B. Authentication verifies the caller; authorization governs allowed actions
C. Authorization means encryption only
D. Authentication permits every action

9. An application uses an API to fetch public branch information. Which statement is accurate?
A. APIs always grant unrestricted database access
B. The API may return a controlled response for the app to display
C. A GUI and API are identical
D. API integration requires blockchain

10. An event-driven notification from one service to another is often called a:
A. Pivot table
B. BIOS setup
C. Webhook
D. Checksum display

11. Which is a sensible protection for confidential API credentials?
A. Publish every secret in webpage source
B. Re-use unrestricted tokens forever
C. Disable all validation
D. Keep tokens and keys appropriately secret and restrict access

12. Which statement about APIs is true?
A. Every API must be on a public website
B. Every API request succeeds immediately
C. Some APIs can operate locally without the public Internet
D. API use makes privacy irrelevant

Answers and explanations — CA-10-06#

1. A — Application Programming Interface. API is Application Programming Interface, a defined software interface for requests/interactions.

2. C — Client. A client initiates the request to a service/endpoint and handles the response.

3. D — A designated operation/address offered by a service. An endpoint indicates where/how a supported API operation is accessed.

4. A — JSON. JSON is a structured text data format commonly used in API requests and responses.

5. D — GET. GET requests a resource representation in common HTTP web APIs.

6. B — 404. HTTP 404 means the addressed resource is not found; exact service response details can vary.

7. A — Authentication is required or credentials are missing/invalid. 401 is a common response for absent or invalid authentication credentials.

8. B — Authentication verifies the caller; authorization governs allowed actions. Verifying identity is separate from deciding which resources/actions are allowed.

9. B — The API may return a controlled response for the app to display. An API defines a controlled interaction and may return data subject to its contract and permissions.

10. C — Webhook. A webhook is a configured event-notification mechanism, distinct from repeated client polling.

11. D — Keep tokens and keys appropriately secret and restrict access. Leaked keys/tokens may enable unauthorized requests; protect and scope credentials.

12. C — Some APIs can operate locally without the public Internet. APIs are defined programmatic interfaces and need not all use the public Internet.#