APIs

An application programming interface (API) defines how one system asks another system for data or an action. The URL, HTTP method, credentials, request body, response body, status codes, and retry rules form a contract that both sides can follow.

Use this hub to move from that contract to a working PHP endpoint or provider integration. The linked guides cover the code, data, and security boundaries behind the request.

Start Here

• Build Your Own API with PHP explains routing, JSON requests, validation, authentication, error responses, and persistent data for a small HTTP API.
• Sending SMS with HTTP APIs follows an outbound provider request through consent, delivery callbacks, retries, and safe logging.

API Contract at a Glance

A small contract should make the resource and outcome visible before client code is written. This request queues a message, while the response confirms acceptance without claiming that delivery has finished.

POST /api/messages
Authorization: Bearer <token>
Content-Type: application/json

{"to":"+61400111222","body":"Your order is ready"}

HTTP/1.1 202 Accepted
{"messageId":"msg_8414","status":"queued"}

Choose methods and status codes deliberately, keep credentials on the correct side of the boundary, and define whether a failed write can be retried safely. The focused tutorials show how those rules change the implementation.

Related Programming Guides

• Backend development places APIs beside server-side languages, databases, and deployment concerns.
• PHP security fundamentals covers validation, authentication, authorization, sessions, and secret handling.
• SQL programming covers the durable records behind API resources, idempotency keys, and audit history.
• Application security provides the wider security path for public endpoints and integrations.

Frequently Asked Questions

What is the difference between an API and a webhook?

An API is something your code calls to request data or trigger an action. A webhook reverses that: the other system calls your endpoint when an event happens, so your server must expose a URL that accepts incoming requests.

What does idempotent mean for an API request?

That making the same call several times leaves the same result as making it once. It is what allows a client to retry safely after a timeout without creating a duplicate order, charge, or message.

What is the difference between REST and GraphQL?

REST exposes several fixed endpoints, each returning a predetermined shape. GraphQL exposes one endpoint where the client states exactly which fields it wants, trading cacheable fixed responses for flexible client-defined queries.

What is API rate limiting?

A cap on how many requests a client may make within a time window, protecting the service from overload and enforcing fair use. Requests past the limit are usually rejected with a 429 status until the window resets.

How is an API key different from OAuth?

An API key is one static secret sent with every request: simple, but hard to scope or revoke selectively. OAuth issues short-lived scoped tokens through an authorisation flow, so permissions can be granted narrowly and expire on their own.

What is the difference between a 401 and a 403 response?

401 means the request carried no valid credentials, so the client should authenticate. 403 means the credentials were understood but do not permit that action, so authenticating again will not help.

What is gRPC?

A binary remote-procedure-call framework over HTTP/2 that generates typed client and server code from a shared schema. It trades REST's readable JSON and universal browser support for smaller payloads and faster service-to-service calls.