API (interface).

An API, which stands for Application Programming Interface, is a programming interface. MDN describes it as a set of functions and rules that allows other software to interact with a program instead of a human user operating an interface. For a company, this is the way to connect the website to the systems behind it: inquiries go into the CRM, job applications into the applicant tracking system, and product data comes from the ERP. Without an API, someone has to enter this data manually, which leads to delays and errors.

How an API Works

One program sends a request to a fixed address, and the other responds with data. With Web APIs, this usually happens via HTTP, and many follow the REST architectural style. The provider’s documentation specifies the available addresses, the expected fields, and how to authenticate. The OpenAPI Initiative has created an open format for this purpose, which allows an HTTP API to be described in a JSON or YAML file, regardless of the programming language.

Every API has its limits. According to HubSpot’s own developer documentation, HubSpot limits the number of requests an app can make per ten seconds and per day, depending on the plan. Anyone who exceeds these limits will receive a 429 error. According to its developer documentation, Personio offers a recruiting API that transfers applications to published job postings. The job postings themselves are imported onto the careers page via an XML feed. Our guide, “How to Create a Careers Page,” shows you how to structure a good careers page.

What You Should Keep in Mind at Work

Before starting the project, determine which systems actually offer an API. Not all software has an open interface, and some features are only available in higher-tier plans. Include every integration in the requirements specification: which system, what data, in which direction, and how often.

Never store access keys in your browser. According to its documentation, Personio advises against calling the recruiting API directly from the browser, because access credentials could be compromised there. The call should be made from the backend or within a server function.

Plan for errors. If the CRM is temporarily unavailable, no request should be lost. In relaunch projects, we often see that integrations were only tested under ideal conditions. That’s why temporary storage and error notifications are essential.

Determine who is responsible for maintaining the integration. Providers change their APIs. According to HubSpot, such changes are announced in advance in the Developer Changelog. Someone at your company or your agency needs to read these notices and take action.

Frequently Asked Questions About the API

What is the difference between an API and a webhook? With an API, a program actively retrieves or sends data. A webhook works the other way around and notifies the system on its own as soon as an event occurs.

Does every integration require custom programming? Not always. Many systems offer ready-made integrations or can be connected via automation services. If you have custom data fields or large volumes of data, a custom integration is often more robust.

Are APIs a data protection issue? Yes, as soon as personal data—such as inquiries or job applications—is transmitted. You should document in advance what data is being sent where and coordinate this with your data protection team.

It's best to document the interfaces your new website needs as early as possible. Our requirements specification template provides the structure you need for this.