What an API is and how REST APIs work
In short: An API is a defined way for one program to ask another for data or actions. REST APIs use HTTPS, URLs that name resources, standard methods such as GET and POST, and usually JSON. Modern network devices, firewalls and cloud platforms all expose REST APIs, so they are a core automation skill.
What an API is
An API (Application Programming Interface) is a contract between two pieces of software. One side says: send me a request in this exact shape and I will reply in that exact shape. You already use APIs every day without seeing them. A weather app on your phone asks a weather service for a forecast; a cloud console asks the provider’s back end to list your virtual machines; a network controller asks a switch for its interface counters.
For network and security engineers the key point is this: a person reads a command-line screen, but a program reads an API. Instead of logging in to fifty firewalls and copying rule counts into a spreadsheet, a script can ask each firewall’s API and receive clean, structured data in seconds.
The REST style
Most web APIs today follow REST (Representational State Transfer), a set of design ideas rather than a strict protocol. A REST API has a few recognisable features:
- Resources: everything is a thing with a name, such as a device, an interface or a user. Each resource has a URL, for example
/api/v1/devices/42. - Standard methods: HTTP methods say what to do. GET reads, POST creates, PUT replaces, PATCH changes part of a resource, DELETE removes it.
- Stateless: each request carries everything the server needs, including credentials. The server does not remember the previous request, which makes APIs easy to scale.
- Representations: the server sends a copy of the resource, usually in JSON (JavaScript Object Notation).
GET /api/v1/devices?site=london HTTP/1.1
Host: nms.example.com
Accept: application/json
Authorization: Bearer <token>The response would be a status code such as 200 OK and a JSON list of devices. You will meet the details of methods, headers and status codes in the next note.
Why APIs beat screen scraping
Before APIs were common, automation meant sending CLI commands over SSH and parsing the text with regular expressions. That still works and is sometimes the only option, but it is fragile: a new software version adds a column and your parser breaks. An API gives you named fields, data types and error codes. Many vendors publish an OpenAPI specification (a machine-readable description of every endpoint), so you can see exactly what each call expects and returns.
| Where you meet APIs | Typical use |
|---|---|
| Network controllers and SD-WAN | List devices, push templates, read health |
| Firewalls | Read rules, add address objects, export logs |
| Cloud platforms | Create networks, security groups and storage |
| Ticketing and chat tools | Open tickets, post alerts |
| IPAM and source of truth | Allocate IP addresses, look up sites |
Other API styles you will hear about
REST is not the only option. SOAP is an older, XML-based style still found in some enterprise systems. GraphQL lets the client ask for exactly the fields it wants in a single query. gRPC uses compact binary messages and is popular for streaming telemetry from network devices. Network devices also offer NETCONF and RESTCONF, which use YANG data models to describe configuration.
Tip: before writing any code, read the API documentation and try one call by hand with a tool such as curl or Postman. Knowing the exact URL, required headers and response shape saves a lot of debugging.
APIs at work and in exams
In a job interview you may be asked to explain what an API is in simple terms, name the main HTTP methods, or say what stateless means. In practice, start with read-only GET calls against a lab system, such as a free sandbox or a controller in your home lab. Common beginner mistakes include ignoring pagination (only reading the first page of results), not checking the status code, and pasting tokens directly into scripts. Treat an API token like a password: store it outside your code and give it only the permissions it needs.
Practice
In one sentence, what is an API?
What does it mean that REST is stateless?
Why is an API usually better than parsing CLI output for automation?
Key takeaways
- An API is a contract that lets programs talk to each other.
- REST uses resources with URLs, standard HTTP methods and usually JSON.
- REST is stateless: every request carries its own credentials and context.
- APIs return structured data, which is more reliable than screen scraping.
- Treat API tokens like passwords and start with read-only calls.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.