Application Programming Interface (API)

| How do API works?

Consider yourself as a waiter in a restaurant. You, the customer, are seated at the table with a menu of options to choose from, and the kitchen is the provider who will fill your order.

A link is required to communicate your order to the kitchen and then to return your food to your table. Because they’re cooking in the kitchen, it can’t be the chef. Something is required to connect the customer ordering food and the chef preparing it. This is where the waiter — or the API — comes in.

The waiter takes your order, delivers it to the kitchen, and instructs the kitchen. The response, in this case the food, is then returned to you.

| Introduction to API

API is an abbreviation for “Application Programming Interface.” An API is a software interface that allows two applications to communicate with one another. In other words, an API is the messenger that sends your request to the provider you’re requesting from and then returns the response to you.

Examples: Log-In Apps, Weather Snippers, Google Maps, Travel Booking, E-Commerce (Shopping Websites).

| Types of API which are commonly used.

1. SOAP API (Simple Object Access Protocol)
2. REST API (Representational State Transfer)

| SOAP API:

1. Data formats: XML and JSON
2. More Secure
3. Message Structure: Envelope, Header, Body, Fault.
4. Need less coding!
5. Slow and Heavier
6. Caching is not possible.

| REST API:

1. Data formats: JSON, HTML, XLT, Python, PHP, or plain text.
2. Less Secure
3. Message Structure: In the form of Postcard.
4. Need little bit more coding!
5. Faster and Lighter
6. Caching is not possible.

| Components of API:

1.Endpoint

An endpoint is the point at which a communication channel terminates. When an API communicates with another system, the points of contact are referred to as endpoints. An endpoint for APIs can include a server or service URL.

2.Methods in API

a) GET: Retrieve information about the REST API resource.

b) POST: Create a REST API resource.

c) PUT: Update a REST API resource.

d) PATCH: Add the additional data in existing resources.

e) DELETE: Delete a REST API resource or related component

3.Header

HTTP Headers are an important part of the API request and response because they contain meta-data about the API request and response. Headers contain data for:

a) Request and Response Body

b) Request Authorization

c) Response Caching

d) Response Cookies

4.Body

A request body is data that a client sends to your API. The data that your API sends to the client is referred to as the response body.

Your API must almost always send a response body. Clients, on the other hand, are not always required to send request bodies.

5.Parameter

Parameters are variables that define variables in a URL path, query parameters, headers, or a request body. In your API definition, you can define parameters for Paths and Path operations. Parameters are variables that define variables in a URL path, query parameters, headers, or a request body.

6.Response Codes

1) 100 Series
These are temporary Responses

• 100 Continue
• 101 Switching Protocols
• 102 Processing

2) 200 Series
The client accepts the Request, being processed successfully at the server.

• 200 — OK
• 201 — Created
• 202 — Accepted
• 203 — Non-Authoritative Information
• 204 — No Content
• 205 — Reset Content
• 206 — Partial Content
• 207 — multi-Status
• 208 — Already Reported
• 226 — IM Used

3) 300 Series
Most of the codes related to this series are for URL Redirection.

• 300 — Multiple Choices
• 301 — Moved Permanently
• 302 — Found
• 303 — Check Other
• 304 — Not Modified
• 305 — Use Proxy
• 306 — Switch Proxy
• 307 — Temporary Redirect
• 308 — Permanent Redirect

4) 400 Series
These are specific to client-side error.

• 400 — Bad Request
• 401 — Unauthorised
• 402 — Payment Required
• 403 — Forbidden
• 404 — Not Found
• 405 — Method Not Allowed
• 406 — Not Acceptable
• 407 — Proxy Authentication Required
• 408 — Request Timeout
• 409 — Conflict
• 410 — Gone
• 411 — Length Required
• 412 — Precondition Failed
• 413 — Payload Too Large
• 414 — URI Too Long
• 415 — Unsupported Media Type
• 416 — Range Not Satisfiable
• 417 — Expectation Failed
• 418 — I’m a teapot
• 421 — Misdirected Request
• 422 — Un processable Entity
• 423 — Locked
• 424 — Failed Dependency
• 426 — Upgrade Required
• 428 — Precondition Required
• 429 — Too Many Requests
• 431 — Request Header Fields Too Large
• 451 — Unavailable for Legal Reasons

5) 500 Series
These are specific to the server-side error.

• 500 — Internal Server Error
• 501 — Not Implemented
• 502 — Bad Gateway
• 503 — Service Unavailable
• 504 — Gateway Timeout
• 505 — HTTP Version Not Supported
• 506 — Variant Also Negotiates
• 507 — Insufficient Storage
• 508 — Loop Detected
• 510 — Not Extended
• 511 — Network Authentication Required

| How are APIs made on the backend?

APIs can be written in a variety of languages, including JavaScript, Golang, and Python, but the concept remains the same.

a) Route

It defines the path for reaching the exact data point or specifies how the API looks.

b) Controller

It contains all of the functions that we must perform, or we can say that it defines actions.

c) Model

Models define what type of data we need and in what format we need it.

| Different methods to keep API secure.

1.HTTPs

REST APIs use HTTP and support Transport Layer Security (TLS) encryption. TLS is a standard that keeps an internet connection private and checks that the data sent between two systems (a server and a server, or a server and a client) is encrypted and unmodified.

2. Password Hash

Password hashing is defined as putting a password through a hashing algorithm (bcrypt, SHA, etc) to turn plaintext into an unintelligible series of numbers and letters. This is important for basic security hygiene because, in the event of a security breach, any compromised hashed passwords are unintelligible to the bad actor. As a result, the theft of this information is considerably more difficult.

3. API-key in URL

If you use an API key, never include it in the URL. This also applies to passwords, usernames, and session tokens. Neither of them should be displayed in the API parameters. When it comes to API keys, those are used between applications to recognize each other.

4. O-Auth

OAuth is one of many solutions you can use to protect your APIs and other resources. It allows users to securely delegate access to resources without sharing their original credentials. OAuth2 (the version of OAuth that this article will cover) has been around since 2012 as a standard and is built on lessons from other, earlier standards, including OAuth1 and SAML.

Being a standard, OAuth benefits from many smart people working together in the open. As a user of this standard, you gain all their hard work without having to hire them! This work includes security analysis, where the group constantly considers different attack vectors and weaknesses in the protocol and ameliorates them. The members of the group also work to support weird edge cases in scale, user interfaces, and network connectivity. If you have a typical auth use case, the OAuth standard almost certainly will work for you.

5. Timestamp and parameter validation

Including a timestamp in the request headers is an excellent way to increase security. The server will be able to determine whether the request was sent in a reasonable amount of time (1–2min). You can include parameter validation as well. If the first step includes strict validation checks, the request can be rejected as soon as the validation fails.