What Is an API

What It Is

An API is a contract. Two systems agree to speak through a narrow, unambiguous doorway. One sends a precisely shaped request. The other returns a precisely shaped response. Nothing else enters. Nothing else exits.

Why It Matters

Every system is a black box. Memory, data, logic — all hidden behind walls. Without an API, the only way to reach that logic is to live inside the box. APIs make the inside reachable from the outside without breaking the walls.

This matters for scale. A single team can own the box. A hundred other teams can use it without knowing the box exists. The API is the membrane between complexity and usability. Get the membrane right, and complexity becomes a service. Get it wrong, and every consumer becomes a co-owner of your bugs.

APIs also matter for trust. A documented, versioned API is a promise. Break it without warning, and you break every downstream system that relied on it. Keep it stable, and you build an ecosystem. APIs are the grammar of interoperability.

How It Works

Four verbs run the world.

GET. You ask for something. The API hands it back. GET /users/42 returns the user with ID 42. If the user does not exist, the API returns a 404. No ambiguity. No guessing.

POST. You create something. POST /users with a JSON body {name: "Ada", role: "engineer"}. The API stores the user and returns the newly created ID. The response is a receipt.

PUT. You replace something entirely. PUT /users/42 with a full new body. The old record is overwritten. The API returns the updated object.

DELETE. You remove something. DELETE /users/42. The API confirms with a 204 or returns the deleted object. The resource is gone.

Every request carries three things: a method (what you want), a path (where to look), and a body (what you are sending). Every response carries a status code (what happened) and a body (what you got back). The shape of the body is defined by the API contract. No surprises.

The Contract

An API contract is a formal agreement. It specifies:

• Endpoints. The exact URLs and HTTP methods available.
• Request shape. Required headers, parameters, and body schema. Miss a required field, and the API returns a 400. No negotiation.
• Response shape. The exact structure of success and error payloads. Field names, types, nesting. Predictable.
• Status codes. 200 means success. 201 means created. 400 means your request was malformed. 401 means unauthorized. 403 means forbidden. 404 means not found. 500 means the server broke. Every code has a single meaning. No reinterpretation.
• Versioning. The contract includes a version. v1 stays stable while v2 evolves. Consumers pin to a version. Breaking changes only happen across version boundaries, never within one.
• Rate limits. The contract defines how many requests per second are allowed. Exceed the limit, and the API returns a 429. Throttling is not a bug. It is part of the contract.

Violate the contract, and the API refuses to play. This is the discipline. The API does not adapt to sloppy inputs. The caller adapts to the contract. That is the whole point.

Real Examples

Stripe. You want to charge a credit card. You POST to https://api.stripe.com/v1/charges with a card token and an amount. Stripe handles PCI compliance, fraud detection, and bank routing. You never touch a card number. The API abstracts away an entire industry.

GitHub. You want to know if a pull request is merged. You GET https://api.github.com/repos/owner/repo/pulls/42. The response JSON contains a merged boolean and a merge_commit_sha. No HTML scraping. No parsing. One request, one answer.

Cloudflare. You want to update a DNS record. You PUT to https://api.cloudflare.com/client/v4/zones/zone_id/dns_records/record_id with the new IP address. The change propagates globally in seconds. You managed global infrastructure from a single HTTP request.

Twilio. You want to send an SMS. You POST to https://api.twilio.com/2010-04-01/Accounts/ACxxx/Messages.json with a To number, a From number, and a Body. Twilio handles carrier routing, delivery receipts, and retries. You sent a message to a phone without knowing how phones work.

OpenAI. You want a model completion. You POST to https://api.openai.com/v1/chat/completions with a message array and a model name. The API returns generated text, token usage, and a finish reason. You invoked a neural network without training one.

Common Mistakes

Treating APIs as documentation. Reading the docs is not understanding the API. Call it. Fail. Read the error. Call it again. The only way to know an API is to exercise it.

Ignoring status codes. A 200 with an error body is a broken API. A 500 with a success message is a lying API. Status codes are part of the contract. They must be truthful and complete.

Building without versioning. You will need to change something. If you did not version from day one, you will either break every consumer or maintain two APIs forever. Versioning is not optional.

Exposing internals. An API should reflect the consumer's model, not the database schema. If your endpoint names match your table names, you leaked your internals. The API is a translation layer, not a window.

Skipping rate limits. Without rate limits, one bad actor or one infinite loop can take down your service. Rate limits are guardrails, not punishments. Build them before you need them.

Connection to OIP

OIP is the Open Interoperability Protocol. Its core belief: systems should be open, deterministic, and auditable.

An API embodies all three.

Open. The contract is published. Any system that speaks the contract can participate. No gatekeeping. No hidden logic. The API is the open door.

Deterministic. The same request always produces the same result. No hidden state. No random behavior. The API is a pure function across a network boundary. Predictability is the foundation of trust.

Auditable. Every request and response is loggable. Every status code is inspectable. When something breaks, you can trace the exact call, the exact payload, and the exact response. There is no mystery. The API makes the invisible visible.

In OIP, an API is not a convenience. It is a constitutional requirement. Systems that do not expose clean, versioned, deterministic APIs cannot participate in the protocol. They are opaque. Opaque systems are untrustworthy systems. The API is the boundary between opacity and interoperability.

Connection to the Grain Philosophy

This API is the interface layer for the Grain philosophy — a living system of self-describing voxels that grows, corrects itself, and expands. The OIP serves the philosophy. The philosophy is the core.