Application programming interface

Application programming interface
Name	Application programming interface
Other names	API
Classification	Software architecture, Protocol (computing)
Related concepts	Library (computing), Software development kit, Web service, Remote procedure call

Application programming interface. An application programming interface is a set of rules, protocols, and tools that enables different software applications to communicate with each other. It defines the methods and data formats that a program can use to request services from an operating system, library, or other service. By abstracting the underlying implementation, it allows developers to build upon existing functionality without needing to understand the internal workings. This concept is fundamental to modern software development, enabling integration across diverse systems and platforms.

Overview

The concept emerged from early work in computer science and software engineering, with foundational ideas present in the design of systems like the IBM System/360. It serves as a contract between different software components, specifying how requests are made and responses are delivered. This abstraction is crucial in environments like the Microsoft Windows operating system or the Java (programming language) platform, where it provides a stable interface for application developers. The widespread adoption of client–server model architectures and the rise of the World Wide Web significantly accelerated its importance, leading to the development of web-based interfaces that power much of today's Internet connectivity.

Design principles

Effective design emphasizes clarity, consistency, and stability to avoid breaking changes for consumers. Principles such as information hiding and separation of concerns, championed by figures like David Parnas, are central to creating robust interfaces. Good design often involves comprehensive documentation, as seen in resources provided by organizations like the World Wide Web Consortium (W3C). The use of versioning strategies is critical for maintaining backward compatibility, a practice rigorously followed by major platforms like the Linux kernel and Apple Inc.'s Cocoa (API). Furthermore, design patterns like facade pattern and adapter pattern are frequently employed to simplify complex underlying systems.

Types of APIs

Several distinct categories exist based on their scope and use case. Operating system APIs, such as the Windows API (Win32) and the POSIX standard, allow applications to interact with core system resources. Library or framework APIs are provided by software like the .NET Framework or the Standard Template Library in C++. Web APIs, also called web services, are accessible over networks using protocols like HTTP; prominent examples include the Twitter API and the Google Maps API. Other types include database APIs like ODBC and JDBC, and hardware APIs for interacting with devices, which are common in ecosystems like Android (operating system).

Specifications and protocols

Formal specifications define the syntax and semantics. For web services, common specifications include SOAP, which uses XML and often relies on the WSDL description language, and REST, an architectural style that leverages standard HTTP methods. Data interchange formats are vital, with JSON (popularized by services like the GitHub API) and XML being ubiquitous. Other important protocols include gRPC, developed by Google, and GraphQL, created by Facebook (company). Industry standards are frequently governed by bodies like the Internet Engineering Task Force (IETF) and the Organization for the Advancement of Structured Information Standards (OASIS).

Security

Securing them is paramount, as they are common attack vectors for data breaches. Standard authentication mechanisms include API keys, used by services like the YouTube API, and more robust protocols like OAuth, employed by Facebook Login and Google Sign-In. Authorization frameworks like OAuth 2.0 and OpenID Connect control access permissions. Threats such as SQL injection, cross-site scripting, and man-in-the-middle attacks must be mitigated through practices like input validation, encryption via Transport Layer Security (TLS), and rate limiting. Security audits and adherence to standards from organizations like Open Web Application Security Project (OWASP) are essential for safe deployment.

Examples and use cases

They are integral to countless modern digital services. Social media platforms like Instagram and LinkedIn provide them for third-party integration and data access. In finance, services like Stripe (company) and Plaid (company) offer interfaces for payment processing and bank connectivity. Mapping and location services, such as those from Mapbox and Here Technologies, rely heavily on them. Within cloud computing, providers like Amazon Web Services (AWS) and Microsoft Azure expose vast arrays of them for managing infrastructure. They also enable the Internet of things (IoT), allowing smart devices from companies like Philips Hue and Nest Labs to communicate with central hubs and applications.

Category:Application programming interfaces Category:Software architecture Category:Interfaces