What Are Application Programming Interfaces?

Application programming interfaces (APIs) are formal contracts that define how software components, services, or systems expose their functionality to external callers, specifying the available operations, required input formats, expected output structures, and error conditions without revealing internal implementation details. An API acts as the boundary layer between a provider that holds data or capabilities and a consumer that wishes to use them, enabling integration between independently developed systems across organizational, platform, and language boundaries. APIs are the foundational mechanism through which modern distributed software ecosystems are assembled: cloud platforms, mobile operating systems, industrial control networks, and financial service infrastructures all expose their core capabilities through published API contracts.

The discipline of API design and governance has grown substantially since the early 2000s, when web services standards and later REST architectural principles gave API publishers a common vocabulary. Today, regulatory frameworks in sectors such as financial services and healthcare mandate that institutions expose APIs to third-party developers, making API design and security a compliance concern as well as a technical one.

APIs in Open Banking

Open banking is the regulatory and technical framework under which financial institutions are required or commercially motivated to expose customer account data and payment initiation capabilities through standardized APIs accessible to licensed third parties. The UK's Open Banking Standard, mandated by the Competition and Markets Authority beginning in 2018, and the European Union's Payment Services Directive 2 (PSD2) are the principal regulatory drivers. These frameworks specify API authentication flows based on OAuth 2.0, resource schemas for account information and payment orders, and consent management requirements that put customers in control of data sharing permissions. Third-party providers authorized under these frameworks can build account aggregation services, personal finance management tools, and payment initiation products that access multiple banks through a uniform API layer. The Open Banking Limited API specifications define the UK implementation, covering read/write data standards and the customer authentication and authorization flows that protect account access.

APIs in Software Defined Networking

Software defined networking (SDN) separates the control plane from the data plane in network devices, centralizing routing and policy decisions in a software controller that communicates with forwarding hardware through well-defined APIs. The northbound API of an SDN controller exposes the network's topology and flow management capabilities to orchestration systems and network applications, typically as a REST interface. The southbound API, most commonly OpenFlow, carries forwarding rules from the controller to switches and routers. This API-driven architecture enables network operators to program traffic routing, enforce quality-of-service policies, and respond to topology changes through software rather than through manual device configuration. The ONF OpenFlow specification maintained by the Open Networking Foundation defines the southbound protocol that SDN controllers use to install flow table entries in compliant switching hardware.

API Security and Lifecycle Management

Security is a first-class concern in API design because APIs are the exposed surface through which services are accessed, and misconfigured or poorly authenticated APIs are a recurring source of data breaches. Authentication mechanisms range from API keys for server-to-server calls to OAuth 2.0 authorization code flows for user-delegated access and mutual TLS for high-assurance service identities. Rate limiting prevents abusive or accidental traffic from degrading service availability. Input validation on all parameters blocks injection attacks. API gateways are infrastructure components that centralize these security controls, route requests to backend services, enforce quotas, and log access for audit purposes. The IETF's OAuth 2.0 Authorization Framework (RFC 6749) is the foundational standard for API authorization flows, describing the grant types used across web, mobile, and service-to-service API integrations.

Applications

Application programming interfaces have applications in a range of fields, including:

• Open banking and financial services, where regulated API access enables third-party fintech products and account portability
• Software defined networking, where northbound and southbound APIs separate network control logic from forwarding hardware
• Healthcare data exchange, where FHIR-compliant APIs provide standardized access to patient records across providers
• Industrial IoT platforms, where device management APIs connect sensors and actuators to cloud analytics and control systems
• Scientific research infrastructure, where data repository APIs enable automated, reproducible access to experimental datasets