In more detail
Web APIs are reached over HTTP at URLs called endpoints and usually exchange JSON. Access is controlled with keys or tokens such as a JWT, and providers use Rate limiting to prevent overuse. Many follow the REST style; others use GraphQL (a single endpoint that takes queries in the request body) or gRPC. A published API is a contract: its documentation lists the endpoints, parameters, response fields and error codes, and a version in the path (/v1/) lets the provider change it without breaking existing clients.
Why it matters
Most apps are thin clients over APIs, and most integrations between services (payments, maps, email) are API calls. When something fails, the status code and error body usually say why: 401 means the key is missing or wrong, 429 that you are calling too often. Treat API keys like passwords: a key committed to a public repository is found and abused quickly.
Example
curl -H "Authorization: Bearer <token>" https://api.example.com/v1/users/42
A successful call returns status 200 OK and a body such as {"id": 42, "name": "Ada"}.