← VCE Software Development U4O2

What an API is

Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 24

Understanding What an API is in VCE Software Development U4O2

What it does: The app sends a defined request to a third-party weather API to use its data without knowing how the weather service works inside. The address belongs to the organisation's own system, so it is an internal API, while a third-party API would use another company's domain. APIs work on request and response. The calling software asks, then the other software answers with data or a result. A third-party API is outside your control. That is why using one adds risk to your software. An API key identifies the calling app or user. The API provider uses it to control, track and limit access.

Common mistakes: The API's JSON response body is missing its closing brace. It must end with } so the receiving software can read the response: {"name": "Ava", "year": 7}. A request starts with an HTTP method such as GET, not REPLY. REPLY is not a real method. GET asks the API to send data back in its response.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add What an API is to a class →

This module's key terms are also in a printable crossword (Modules 23–47) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What does an API let one piece of software do?

Copy the entire source code of another piece of software into its own projectSend a defined request to use the data or functions of another piece of software

Matches

An API is a user interface where people click buttons to use an app

↓

An API is not for people to click. It is a set of defined requests that lets one piece of software use the data or functions of another.

Applying

Meanings

Term

API

Meaning

Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.

Practice

function weatherApi(request) {

Testing

Gaps

const res = await (url);

Check Answer

Spots

3Content-Length: 26

4{"name": "Ava", "year": 7

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does an API let one piece of software do?

A. Send a defined request to use the data or functions of another piece of software ✓

B. Copy the entire source code of another piece of software into its own project

An API is a set of defined requests. It gives access to another system's data or functions without exposing its source code.

2. Which describes the basic pattern of how an API works?

A. The API sends a response first and the client replies with a request

B. The client sends a request and the API sends back a response ✓

APIs work on request and response. The calling software asks, then the other software answers with data or a result.

3. A school app asks a weather service API for tomorrow's forecast. What is the forecast data that comes back?

A. The response ✓

B. The request

The request is the question sent to the API. The response is the data or result returned to the app.

4. Which is an example of an internal API?

A. A company's payroll system calling the company's own employee database API ✓

B. A company's app calling a payment provider's API owned by another business

Internal APIs are built and controlled by the organisation that uses them. An API owned by another business is third-party.

5. Which statement about third-party APIs is correct?

A. They are controlled by your own developers, so you decide how they are secured

B. They are owned by another organisation, so you rely on their security and availability ✓

A third-party API is outside your control. That is why using one adds risk to your software.

Match the Pairs

GET /api/students/42 → A request sent to an API asking for the data of one student, which the API answers with a response

Authorization: Bearer abc123token → A token sent with an API request to prove the caller is allowed to use the API

An API lets your app use a function of another piece of software by sending a defined request → weather = requests.get("https://api.weather.com/today")

An internal API is built and used within your own organisation, unlike a third-party API owned by another company → GET https://intranet.school.edu/api/timetable

An API is a user interface where people click buttons to use an app → An API is not for people to click. It is a set of defined requests that lets one piece of software use the data or functions of another.

api_key = "sk_live_8f3a91c2" # saved in the shared code file → The API key is hard-coded in the source code, so anyone with access to the code can steal it and misuse the API.

Key Term

API

Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.

Fill in the Blanks

1. const res = await fetch(url);

Hint: Type the built-in function that sends a request to an API address.

2. GET /students HTTP/1.1 Host: api.school.edu

Hint: Type the HTTP method used to ask an API to send data back.

3. const options = { headers: { "x-api-key": key } };

Hint: Type the property name that carries extra details, like an API key, with the request.

4. const res = await fetch(url); const data = await res.json();

Hint: Type the method that reads the response body as structured data.

5. if (res.status === 200) { console.log("Request succeeded"); }

Hint: Type the status code number that means the API request was successful.

Spot the Error

Question 1

A HTTP/1.1 200 OK

B Content-Type: application/json

C Content-Length: 26

D {"name": "Ava", "year": 7

Line D — The API's JSON response body is missing its closing brace. It must end with } so the receiving software can read the response: {"name": "Ava", "year": 7}.

Question 2

A REPLY /api/weather?city=Perth

B Host: api.weatherco.com

C x-api-key: k9f2a7

Line A — A request starts with an HTTP method such as GET, not REPLY. REPLY is not a real method. GET asks the API to send data back in its response.

Question 3

A key = os.getenv("PAY_KEY")

B h = {"x-api-key": "key"}

C r = get(URL, headers=h)

Line B — Putting key in quotes sends the literal text "key" instead of the stored API key. It should be h = {"x-api-key": key} so the third-party API can identify the app.

Question 4

A r = get(URL, headers=h)

B if r.status = 200:

C data = r.json()

D print(data["temp"])

Line B — A single = assigns a value, but the program needs to compare the response status with 200 (OK). It should be if r.status == 200:.

Question 5

A GET /profile HTTP/1.1

B Host: api.school.edu.au

C Authorisation: Bearer t8f2

Line C — The HTTP header name is spelt with a z: Authorization. The Australian spelling 'Authorisation' means the API will not see the token and will reject the request.

Student with a class code? Join your class →