REST API
A REST API is a web API built on the conventions of HTTP, where each kind of data has its own web address and standard methods such as GET, POST, PUT and DELETE read, create, change and remove it.
REST (representational state transfer) is a style, not a product or a strict standard. It is the most common way web services expose an API, because it uses the same plumbing as ordinary web pages: addresses, requests and status codes. That makes REST APIs familiar to developers and easy to test.
Other styles exist, such as GraphQL, which lets the caller ask for exactly the fields it wants in one request. For an owner the style rarely matters. What matters is that the API is documented, stable, secured and covers what you need.
How it works
Each type of thing gets an address, called an endpoint, such as one for customers and one for orders, with individual items reached by adding an ID to the address. A GET request to the customers endpoint lists customers, a POST adds one, a PUT or PATCH updates one and a DELETE removes it. The server answers with data, usually in JSON, and an HTTP status code.
The status codes are the same ones the web uses for pages: 200 means success, 201 that something was created, 400 that the request was malformed, 401 that it was not authenticated, 403 that it was not allowed, 404 that the item does not exist and codes in the 500s that the server itself failed. Integrations use these codes to decide whether to carry on, retry or raise an alert.
Each request carries everything the server needs, including the access key, so the server does not have to remember earlier requests. This property, called statelessness, makes REST APIs simple to spread across several servers and to put behind caching, because any server can answer any request.
Example
An online shop built on WordPress with an ecommerce plugin wants its products shown in a separate mobile app. The platform includes a REST API, so the app sends a GET request to the products endpoint and receives names, prices and image links as JSON. When staff edit a price in the admin, the app shows the new price on its next request.
During a review, the developer notices that the default users endpoint reveals, to anyone who asks, the account names of everyone who has published posts, often including the administrator. Those usernames are half of what an attacker needs to try guessing passwords, so the endpoint is restricted to logged-in staff. The app keeps working because it never needed that data.
Why it matters for your business
If a tool you are choosing offers a well-documented REST API, you can connect it to your site and other systems later without being locked into the vendor's own integrations. That flexibility has real value as you grow. A missing or poorly documented API is a warning sign worth raising before you commit. On the other side, if your own site exposes an API, someone should check what it reveals, because platforms often switch theirs on by default. A developer can review which endpoints are public and what each one returns to a stranger, which is a small job set against the risk of leaking customer or staff details.
Common mistakes
- Leaving an API open without authentication so anyone can read the data behind it.
- Returning far more data than the caller needs, including private fields such as email addresses.
- Changing an endpoint without warning and breaking every app or integration that relies on it.
- Ignoring rate limits and having requests refused at the busiest moment.
Questions people ask
What is the difference between an API and a REST API?
API is the general idea of a defined way for software to talk to other software. A REST API is one particular style of web API that uses addresses for each kind of data and the standard HTTP methods. Every REST API is an API, but not every API is REST.
Is REST better than GraphQL?
Neither is better in general. REST is simpler, more widely supported and easy to cache. GraphQL suits apps that need many related pieces of data in flexible combinations. For most business integrations, REST is the familiar and sufficient choice.
Does my website have a REST API?
Possibly. WordPress and many other CMS and ecommerce platforms include one by default. Your developer can tell you what it exposes and whether parts of it should be restricted, because default APIs sometimes reveal more than owners expect, such as usernames.
