In this article · 8 sections
Your website talks to payment gateways, WhatsApp, Google Maps and SMS services through APIs. A REST API is the most common style: a set of URLs (endpoints) that accept HTTP requests and usually return JSON.
The restaurant analogy
You (the client) don't go into the kitchen (the server). You give an order to the waiter (the API) in a standard format, and the waiter brings back your food (the response).
Key concepts
- Resource: a thing, such as bookings, cars or customers
- Endpoint: the URL for a resource, e.g.
/api/bookings - Method: what you want to do
- Response: data (usually JSON) plus a status code
HTTP methods
| Method | Meaning | Example |
|---|---|---|
| GET | Read | GET /api/bookings/15 |
| POST | Create | POST /api/bookings with booking data |
| PUT / PATCH | Update | PATCH /api/bookings/15 with {"status":"confirmed"} |
| DELETE | Remove | DELETE /api/bookings/15 |
Status codes
| Code | Meaning |
|---|---|
| 200 OK | Success |
| 201 Created | New resource created |
| 400 Bad Request | Invalid input |
| 401 Unauthorized | Missing or invalid authentication |
| 403 Forbidden | Not allowed |
| 404 Not Found | Resource doesn't exist |
| 429 Too Many Requests | Rate limit hit |
| 500 Server Error | Something broke on the server |
A tiny PHP endpoint
<?php
header('Content-Type: application/json');
$method = $_SERVER['REQUEST_METHOD'];
if ($method === 'GET') {
$res = $conn->query("SELECT id, route, fare FROM routes ORDER BY route");
echo json_encode($res->fetch_all(MYSQLI_ASSOC));
} elseif ($method === 'POST') {
$data = json_decode(file_get_contents('php://input'), true);
if (empty($data['route'])) {
http_response_code(400);
echo json_encode(['error' => 'route is required']);
exit;
}
// insert with a prepared statement…
http_response_code(201);
echo json_encode(['ok' => true]);
} else {
http_response_code(405);
echo json_encode(['error' => 'Method not allowed']);
}
Call it from JavaScript with fetch. See fetch and AJAX tutorial.
Authentication
- API keys in headers (e.g.
Authorization: Bearer <token>) for server-to-server calls - Never put secret keys in frontend JavaScript; anyone can see them
- Use HTTPS always
- Rate-limit public endpoints
Testing APIs
Tools like Postman, Insomnia, or curl in the terminal let you send requests and inspect responses.
FAQs
What's the difference between an API and a website?
A website returns HTML for people; an API returns data (usually JSON) for programs.
What is GraphQL?
Another API style where the client asks for exactly the fields it needs. REST is simpler for most small projects.
Was this article helpful?
Your answer helps us improve our guides