What an API is

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does an API let one piece of software do?

A Send a defined request to use the data or functions of another piece of software

B Copy the entire source code of another piece of software into its own project

2. Which describes the basic pattern of how an API works?

A The API sends a response first and the client replies with a request

B The client sends a request and the API sends back a response

3. A school app asks a weather service API for tomorrow's forecast. What is the forecast data that comes back?

A The response

B The request

4. Which is an example of an internal API?

A A company's payroll system calling the company's own employee database API

B A company's app calling a payment provider's API owned by another business

5. Which statement about third-party APIs is correct?

A They are controlled by your own developers, so you decide how they are secured

B They are owned by another organisation, so you rely on their security and availability

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1GET /api/students/42		Aweather = requests.get("https://api.weather.com/today")
2Authorization: Bearer abc123token		BGET https://intranet.school.edu/api/timetable
3An API lets your app use a function of another piece of software by sending a defined request		CA request sent to an API asking for the data of one student, which the API answers with a response
4An internal API is built and used within your own organisation, unlike a third-party API owned by another company		DThe API key is hard-coded in the source code, so anyone with access to the code can steal it and misuse the API.
5An API is a user interface where people click buttons to use an app		EAn API is not for people to click. It is a set of defined requests that lets one piece of software use the data or functions of another.
6api_key = "sk_live_8f3a91c2" # saved in the shared code file		FA token sent with an API request to prove the caller is allowed to use the API

Definitions

API

Fill in the Blanks

Complete each line of code by filling in the missing parts.

const res = await _____(url);

___ /students HTTP/1.1 Host: api.school.edu

const options = { _______: { "x-api-key": key } };

const res = await fetch(url); const data = await res.____();

if (res.status === ___) { console.log("Request succeeded"); }

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A HTTP/1.1 200 OK

B Content-Type: application/json

C Content-Length: 26

D {"name": "Ava", "year": 7

Question 2

A REPLY /api/weather?city=Perth

B Host: api.weatherco.com

C x-api-key: k9f2a7

Question 3

A key = os.getenv("PAY_KEY")

B h = {"x-api-key": "key"}

C r = get(URL, headers=h)

Question 4

A r = get(URL, headers=h)

B if r.status = 200:

C data = r.json()

D print(data["temp"])

Question 5

A GET /profile HTTP/1.1

B Host: api.school.edu.au

C Authorisation: Bearer t8f2

Answer Key

What an API is

Section A: Quick Questions

A — Send a defined request to use the data or functions of another piece of software

B — The client sends a request and the API sends back a response

A — The response

A — A company's payroll system calling the company's own employee database API

B — They are owned by another organisation, so you rely on their security and availability

Section B: Match the Pairs

GET /api/students/42 → A request sent to an API asking for the data of one student, which the API answers with a response

Authorization: Bearer abc123token → A token sent with an API request to prove the caller is allowed to use the API

An API lets your app use a function of another piece of software by sending a defined request → weather = requests.get("https://api.weather.com/today")

An internal API is built and used within your own organisation, unlike a third-party API owned by another company → GET https://intranet.school.edu/api/timetable

An API is a user interface where people click buttons to use an app → An API is not for people to click. It is a set of defined requests that lets one piece of software use the data or functions of another.

api_key = "sk_live_8f3a91c2" # saved in the shared code file → The API key is hard-coded in the source code, so anyone with access to the code can steal it and misuse the API.

Section C: Definitions

API — Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.

Section D: Fill in the Blanks

const res = await fetch(url);

GET /students HTTP/1.1
Host: api.school.edu

const options = {
  headers: { "x-api-key": key }
};

const res = await fetch(url);
const data = await res.json();

if (res.status === 200) {
  console.log("Request succeeded");
}

Section E: Spot the Error

D — The API's JSON response body is missing its closing brace. It must end with } so the receiving software can read the response: {"name": "Ava", "year": 7}.

A — A request starts with an HTTP method such as GET, not REPLY. REPLY is not a real method. GET asks the API to send data back in its response.

B — Putting key in quotes sends the literal text "key" instead of the stored API key. It should be h = {"x-api-key": key} so the third-party API can identify the app.

B — A single = assigns a value, but the program needs to compare the response status with 200 (OK). It should be if r.status == 200:.

C — The HTTP header name is spelt with a z: Authorization. The Australian spelling 'Authorisation' means the API will not see the token and will reject the request.