In short
An API is a set of published requests that a system will accept and the responses it will send back. A booking system’s API might allow requests such as “list free slots on Tuesday” or “create a booking for this customer”. The system that offers the API decides what is possible, who may use it, and how much they may use it.
A simple way to picture it
Think of an API as a service counter. You cannot walk into the kitchen of a restaurant and cook, but you can order from a menu at the counter. The menu lists what you can ask for and the format the order must take. The kitchen does the work and hands back the result.
Software works the same way. Your website does not reach into your CRM’s database. It sends a request to the CRM’s API, such as “create a contact with these details”, and the CRM checks the request, saves the contact and replies to confirm.
The terms you will hear
| Endpoint | A specific address that accepts one kind of request, such as creating a contact or listing invoices. |
|---|---|
| Request and response | The message sent to the API and the reply it sends back, usually in a structured text format called JSON. |
| REST API | A common style of web API that uses standard web requests to read, create, update and delete records. |
| API key or token | A secret credential that identifies who is calling and what they are allowed to do. Treat it like a password. |
| Webhook | The reverse direction: a system sends a message to a web address you choose the moment something happens, such as a new booking. |
| Rate limit | A cap on how many requests you can make in a period, set by the provider to protect its service. |
Why APIs decide what you can automate
Every workflow tool, AI agent and integration depends on APIs. When an AI voice agent books an appointment, it is calling the calendar’s API. When a workflow tool copies a form enquiry into a CRM, it is calling the CRM’s API. If the API does not offer the action you need, no amount of clever AI will add it.
That makes the API a practical buying question. Before choosing a new CRM, booking system or accounting package, ask whether it has a documented API, which actions it supports, whether API access is included in your plan or costs extra, and whether it can send webhooks. Two systems with similar features can differ widely in how easily they connect.
When a system has no API
Older or very simple systems sometimes have no API, or only a limited one. The options are then less attractive: scheduled file exports and imports, email parsing, or robotic process automation that imitates a person clicking through screens. These can work, but they break more easily when anything changes, so they need closer monitoring.
Sometimes the better answer is to replace the system. An audit should weigh the cost of working around a closed system against the cost of moving.
Security basics
API keys give direct access to your data, so store them in a proper secrets manager or your automation tool’s credential store, never in a shared spreadsheet or an email. Give each connection the narrowest permissions it needs, use separate keys for separate tools so one can be revoked without breaking the rest, and remove keys when a supplier or staff member leaves.
When this matters
Relevant whenever you plan to connect systems or choose new software. New Era AI’s integrations service builds and maintains API connections, and an audit checks which of your current tools can be connected before any build is quoted.
Questions
Do we need to understand APIs to use automation?
Not in detail. It helps to know whether your main systems have APIs and what they allow, because that sets the limits of what can be automated.
What is the difference between an API and a webhook?
With an API, your system asks another system for something. With a webhook, the other system tells yours when something happens. Many integrations use both.
Is it safe to give an automation tool our API keys?
It can be, if the tool is reputable, stores credentials securely and you limit each key to the permissions it needs. Review which keys exist and who holds them at least once a year.