Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

AI APIs

What is an API, and how does it work?

An API is a defined way for one program to ask another for data or actions. How web APIs work, requests and responses, authentication, and what to watch.

An API, application programming interface, is a defined way for one program to request data or actions from another. On the web, it is usually a set of URLs, called endpoints, that accept HTTP requests and return data, typically JSON. Your app sends a request with any required key, and the service answers with a status code and data.

Published · Last updated

By Michal Měřínský. Audit methodology.

The idea

An API is a contract. The service promises: send me a request in this shape, and I will respond in that shape. You do not need to know how it works inside. Weather data, payments, maps, sending email and AI text generation are all used through APIs.

How a web API request looks

curl https://api.example.com/v1/orders/123 \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Accept: application/json"
  • Method: GET to read, POST to create, PUT or PATCH to update, DELETE to remove.
  • Endpoint: the URL for a resource.
  • Headers: authentication, content type and other metadata.
  • Body: data you send, usually JSON, for POST and PUT. The response carries a status code, such as 200 for success, 401 for missing authentication or 429 for too many requests, and usually a JSON body.

Common styles

  • REST: resources at URLs with standard HTTP methods. The most common style.
  • GraphQL: one endpoint where the client describes exactly which data it wants.
  • Webhooks: the reverse direction, where a service calls your URL when something happens, such as a completed payment.

Authentication

Most APIs need proof of who is calling: an API key, an OAuth token or a signed request. Keys identify your account and often decide what you are billed. They belong on your server, not in browser code.

What to watch when using an API

  • Rate limits and quotas. Handle 429 with backoff.
  • Errors. Check the status code before using the body.
  • Costs. Many APIs bill per request or per token.
  • Versioning. Pin a version and read the changelog before upgrading.
  • Webhook security. Verify signatures on incoming webhook calls.

If your app calls an API directly from the browser with a secret key, anyone can copy the key from the network panel. Call it from your backend instead.

What a scan can and cannot tell you

WebAuditOS checks CORS and nosniff headers on responses fetched by its crawler, and observes failed requests during sampled browser loads. That does not grade every endpoint the page calls at runtime.

It does not test your API's authentication, authorization or business logic, and it does not detect secret keys in your JavaScript.

A sampled browser load can observe failed API requests, but it does not audit authorization or grade the headers of every runtime API response. Test authorization directly.

Short answers

Is an API the same as a website? No. A website is for people, an API is for programs, though both use HTTP.

What is a REST API? An API that exposes resources at URLs and uses HTTP methods to act on them.

Do I need to code to use an API? Usually, though no-code tools and AI builders can call APIs for you.

What is an API key? A secret that identifies your account to the API.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

AI APIs

What is an API key, and how do you keep it secret?

An API key identifies your account to a service and often decides what you are billed. Where keys belong, how they leak, and what to do when one is exposed.

Security

What is a CORS error, and how do you fix it?

A CORS error means the browser blocked a request to another origin because the server did not allow it. Why it happens and how to fix it on the server.