API • 0xnhl

An API (Application Programming Interface) is a set of rules and protocols that allows different software applications to communicate with each other.
APIs are used by websites or mobile apps to talk to the server and exchange information.

API Architectures#

REST#

Representational State Transfer (REST) uses standard HTTP methods (GET, POST, PUT, DELETE) and is stateless and resource-based. It uses JSON and uses standards such as Swagger and the OpenAPI Specification ( https://www.openapis.org ↗ ) for ease of documentation and to encourage adoption. Know more https://www.w3.org/2001/sw/wiki/REST ↗

SOAP#

Simple Object Access Protocol (SOAP) project files: SOAP is an API standard that relies on XML and related schemas. XML-based specifications are governed by XML Schema Definition (XSD) documents. Having a good reference of what a specific API supports can be very beneficial for a penetration tester and will accelerate the testing. The SOAP specification can be accessed at https://www.w3.org/TR/soap ↗.

Swagger#

Swagger (OpenAPI) documentation is a modern framework of API documentation and development that is now the basis of the OpenAPI Specification (OAS). These documents are used in representational state transfer (REST) APIs. REST is a software architectural style designed to guide development of the architecture for web services (including APIs). REST, or “RESTful,” APIs are the most common types of APIs used today. Swagger documents can be extremely beneficial when testing APIs. Additional information about Swagger can be obtained at https://swagger.io ↗. The OAS is available at https://github.com/OAI/OpenAPI-Specification ↗.

WSDL#

Web Services Description Language (WSDL) is an XML-based language that is used to document the functionality of a web service. The WSDL specification can be accessed at https://www.w3.org/TR/wsdl20-primer ↗.

GraphQL#

GraphQL is a query language for APIs. It is also a server-side runtime for executing queries using a type system you define for your data. Additional technical information about GraphQL can be accessed at https://graphql.org/learn ↗.

WADL#

Web Application Description Language (WADL) is an XML-based language for describing web applications. The WADL specification can be obtained from https://www.w3.org/Submission/wadl ↗.

WebSockets#

Enables real-time, two-way communication channels over a single TCP connection

Common Types of APIs#

Public (Open) APIs: Available for any external developer to use, often with a key or free tier (e.g., weather data or mapping services)
Private (Internal) APIs: Used exclusively within a single organization to connect its own systems and data.
Partner APIs: Shared between specific business partners to facilitate integrated services