API

In plain words

An API is a service window between programs. One program steps up and says, in a strictly defined phrase, “give me yesterday’s payments” or “send this message to the client”. The other checks whether it has the right and carries it out. No person is involved.

What it looks like in practice

A website receives a request and passes it through an API into the customer records system. A payment system reports through an API that a customer has paid. A reporting spreadsheet pulls fresh figures every hour. Each such connection is called an integration.

Access to an API is usually granted by a key, a long string that works like a password. A key has rights: read only, read and write, or access to certain sections.

Why it matters to a manager

An API saves hours of manual data transfer and removes errors like “copied to the wrong place”. But every key is access to company data. A key left with a contractor who built an integration three years ago is an open door.

The second point is dependency. If a process rests on someone else’s API, the rules can change: request limits, a removed feature, new terms. Take this into account when planning.

A common mistake

Not keeping a register of keys. Nobody knows how many have been issued, to whom and with what rights. When a contractor changes or a developer leaves, keys must be revoked and new ones issued.

The principle is simple: minimum rights, a clear owner for every key, regular review.