Modern IT landscapes consist of many specialized systems: ERP, CRM, online shop, accounting, Microsoft 365. So that data does not have to be transferred by hand, these systems talk to each other through APIs. An API defines which requests a system accepts and what it returns, without the other side needing to know its inner workings.
How does an API work?
An API is a kind of contract: it describes the available functions, data formats and responses. In business settings, the most common type is the web API. It is reachable over HTTP and often follows the REST principle:
- Data is addressed as resources at specific addresses, for example a customer record at its own URL.
- HTTP methods define the action: GET reads, POST creates, PUT or PATCH changes, DELETE deletes.
- Data is usually transferred in JSON format.
- Status codes report success or failure, for example 200 for "OK" or 404 for "not found".
Access is secured with API keys or tokens, often based on the OAuth 2.0 standard. Many providers document their interfaces in the OpenAPI format and limit the number of requests per time period. Besides REST, there are other forms such as GraphQL or SOAP, as well as programming interfaces of operating systems and software libraries.
Typical examples
- An online shop automatically passes orders to the ERP system.
- The accounting software retrieves account transactions from the bank.
- Microsoft Graph lets you manage user accounts, calendars or files in Microsoft 365 automatically.
- A monitoring system creates a ticket on its own when a fault occurs.
- AI applications access company data through APIs or the Model Context Protocol.
What companies should keep in mind
- Treat API keys like passwords: do not share them in source code or by email, store them securely and renew them regularly.
- Give each integration only the permissions it really needs.
- When selecting software, look for open, documented interfaces. Closed systems make process automation harder.
- Plan for version changes, deprecated functions and request limits, and monitor your interfaces.
How it differs
With an API, one system actively requests data. With a webhook, the source system reports on its own as soon as an event occurs.
How TOMORIS relates
With GRID.WHISPER, you can share credentials such as API keys through limited, browser-encrypted links instead of by email.
View automation