---

What is an API?

API (Application Programming Interface) is a contract that allows two software systems to communicate with each other.

Instead of one application directly accessing another application's database or internal implementation, it communicates through well-defined API endpoints.

Think of an API as a waiter in a restaurant.

Customer

↓

Waiter (API)

↓

Kitchen

↓

Waiter (API)

↓

Customer

The customer never enters the kitchen.

Similarly, clients never directly access business logic or databases.

---

Why Do We Need APIs?

Without APIs:

Application A

↓

Direct Database Access

↓

Application B

Problems:

• Tight coupling
• Security risks
• Difficult maintenance
• No version control
• Difficult scaling

With APIs:

Client

↓

API

↓

Business Logic

↓

Database

Benefits:

• Loose coupling
• Better security
• Independent deployments
• Reusability
• Standard communication

---

Real-World Example

Suppose a mobile banking application needs account information.

Instead of connecting directly to the banking database:

Mobile App

↓

GET /accounts/1001

↓

Bank API

↓

Account Service

↓

Database

↓

JSON Response

The mobile app only understands the API contract.

---

API Communication Flow

Client

↓

DNS

↓

Load Balancer

↓

API Gateway

↓

Authentication

↓

Business Service

↓

Database

↓

Business Service

↓

Gateway

↓

Client

Every production API follows a similar flow.

---

Types of APIs

1. Public APIs

Accessible by external developers.

Examples:

• Google Maps API
• GitHub API
• Stripe API

---

2. Private APIs

Used only inside an organization.

Example:

Order Service

↓

Inventory Service

---

3. Partner APIs

Shared with trusted partners.

Example:

Insurance Company

↓

Hospital API

---

4. Internal Microservice APIs

Communication between backend services.

Payment Service

↓

Customer Service

↓

Notification Service

---

Common API Styles

Style	Data Format	Common Usage
REST	JSON	Most web applications
GraphQL	JSON	Flexible client queries
gRPC	Protocol Buffers	High-performance microservices
SOAP	XML	Enterprise legacy systems

---

Internal Working

Suppose the client requests:

GET /employees/101

The request travels like this:

Client

↓

Load Balancer

↓

API Gateway

↓

Authentication Filter

↓

Employee Controller

↓

Employee Service

↓

Employee Repository

↓

Database

↓

Repository

↓

Service

↓

Controller

↓

JSON Response

Each layer has a separate responsibility.

---

Request Lifecycle

Receive Request

↓

Validate Request

↓

Authenticate User

↓

Authorize Access

↓

Business Logic

↓

Database

↓

Build Response

↓

Return HTTP Status

---

Spring Boot Example

Controller

@RestController
@RequestMapping("/employees")
public class EmployeeController {

    @GetMapping("/{id}")
    public Employee getEmployee(
            @PathVariable Long id) {

        return new Employee(
                id,
                "John",
                "Engineering"
        );
    }

}

---

Employee Class

public class Employee {

    private Long id;

    private String name;

    private String department;

    public Employee(
            Long id,
            String name,
            String department) {

        this.id = id;
        this.name = name;
        this.department = department;
    }

    public Long getId() {
        return id;
    }

    public String getName() {
        return name;
    }

    public String getDepartment() {
        return department;
    }

}

---

Step-by-Step Explanation

Step 1

The browser calls:

GET /employees/101

---

Step 2

Spring Boot matches

@GetMapping("/{id}")

---

Step 3

The value

101

is stored inside

@PathVariable Long id

---

Step 4

Controller creates an Employee object.

---

Step 5

Spring Boot automatically converts the Java object into JSON.

---

Response

{
  "id":101,
  "name":"John",
  "department":"Engineering"
}

This automatic conversion is performed by Jackson.

---

Request Example

GET /employees/101 HTTP/1.1

Host: api.company.com

Accept: application/json

---

Response Example

HTTP/1.1 200 OK

Content-Type: application/json

{
  "id":101,
  "name":"John",
  "department":"Engineering"
}

---

HTTP Status Codes

Code	Meaning
200	Success
201	Created
204	No Content
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found
409	Conflict
500	Internal Server Error

---

Production Example

Consider an e-commerce checkout.

Customer

↓

Checkout API

↓

Inventory API

↓

Payment API

↓

Shipping API

↓

Notification API

Every interaction happens through APIs.

---

Where APIs Are Used

• Mobile applications
• Banking systems
• Insurance platforms
• Healthcare systems
• Cloud platforms
• E-commerce
• IoT devices
• AI services
• Payment gateways
• Microservices

---

Advantages of APIs

• Loose coupling
• Language independence
• Platform independence
• Easy maintenance
• Better security
• Scalability
• Reusability
• Faster development
• Third-party integrations

---

Common Mistakes

Exposing Database Tables

Bad:

/customer_table

Good:

/customers

---

Returning Internal Errors

Bad:

ORA-00942

NullPointerException

Good:

{
  "code":"CUSTOMER_NOT_FOUND",
  "message":"Customer not found."
}

---

Ignoring Versioning

Avoid changing existing APIs without a versioning strategy.

---

Returning Inconsistent Responses

Keep response structures consistent across endpoints.

---

Best Practices

• Use nouns for resource names.
• Return proper HTTP status codes.
• Validate every request.
• Secure APIs with authentication.
• Document APIs using OpenAPI.
• Use pagination for large datasets.
• Return meaningful error messages.
• Log requests using correlation IDs.
• Monitor latency and failures.
• Keep APIs backward compatible.

---

Production Interview Scenarios

Scenario 1

A mobile application suddenly receives HTTP 500 errors.

Where would you investigate?

Expected approach:

• API Gateway logs
• Application logs
• Database connectivity
• Downstream service health
• Distributed traces

---

Scenario 2

An API suddenly becomes slow.

Possible causes:

• Database queries
• Network latency
• Missing indexes
• Connection pool exhaustion
• External API delays

---

Scenario 3

Two teams need the same customer information.

Should both query the database directly?

No.

Expose a shared Customer API instead.

---

Frequently Asked Interview Questions

1. What is an API?

An API is a contract that allows software systems to communicate through well-defined interfaces.

---

2. Why are APIs important?

They provide loose coupling, security, reusability, and independent deployments.

---

3. What is the difference between an API and a Web Service?

All web services expose APIs, but APIs are not limited to web technologies.

---

4. What are the common API styles?

REST, GraphQL, gRPC, SOAP.

---

5. Why shouldn't clients access databases directly?

It breaks encapsulation, introduces security risks, increases coupling, and makes maintenance difficult.

---

6. What format is commonly used in REST APIs?

JSON.

---

7. What happens when a request reaches Spring Boot?

Spring routes it to a controller, executes business logic, converts the Java object into JSON, and returns an HTTP response.

---

8. What are the main components involved in a production API call?

Client, Load Balancer, API Gateway, Authentication, Service, Repository, Database.

---

9. What is an endpoint?

An endpoint is a unique URL that exposes a specific API operation.

---

10. What is the biggest mistake in API design?

Designing APIs around database tables instead of business resources.

---

Quick Revision

Topic	Summary
API	Software communication contract
Purpose	Enable communication between systems
Common Styles	REST, GraphQL, gRPC, SOAP
Data Format	Usually JSON
Production Flow	Client → Gateway → Service → Database
Response	HTTP Status + Body
Most Used Framework	Spring Boot
Interview Frequency	⭐⭐⭐⭐⭐

---

Key Takeaways

• APIs enable secure and standardized communication between software systems.
• Clients communicate with APIs instead of directly accessing databases.
• Production APIs typically flow through gateways, authentication, business services, and databases.
• Spring Boot simplifies API development using controllers and automatic JSON serialization.
• Understanding API fundamentals is essential before learning REST, GraphQL, gRPC, API security, gateways, and production API design.

---