What is an API? Easy-to-understand explanation for business owners who want to automate

API (Application Programming Interface)

API is a "communication gateway" for two pieces of software to talk to each other without a person in the middle: accounting software receives an invoice from sales software, a bank notifies your website of incoming money, your application calls OpenAI's ChatGPT or Anthropic's Claude to write content. Understanding API is the first step to automating work, because almost every automation tool like n8n, Make, Zapier, or AI agents run on APIs. This post explains API in plain language, with real examples from opcaios.org verified on 22/10/2026. First comes the concept, then the structure of one call, finally security.

One API call: application sends request with key, server checks then returns result. Diagram: OPCAIOS.

What is API?

API is a communication gateway with clear rules between two pieces of software, and the easiest way to understand it is to imagine a restaurant. You (the customer) don't go into the kitchen to cook yourself but place an order through a waiter, the waiter takes your request to the kitchen and brings the dish out. You don't need to know how the kitchen cooks, just need to order correctly from the menu. API is that waiter:

• Customer is software that needs data or needs to do something, like your application, an n8n workflow, or an AI agent.
• Kitchen is the system holding data or capability, like a bank, sales software, or OpenAI's AI model.
• Menu is the API documentation: it lists what requests are allowed, what you need to send, and what you'll get back.

Thanks to API, each piece of software keeps its inner workings secret, but still opens a regulated door for other software to use. For example, opcaios.org opened its own API in 2026 so n8n could read the list of posts without needing to log into the admin page.

What does one API call contain?

One API call is one HTTP request, the same protocol browsers use to open websites, and most modern APIs are web APIs like this. According to opcaios.org's API (2026), one call has five components, and when the key is missing the server returns code 401:

Component	Meaning	Example
Endpoint	Address of the "dish" you're ordering	https://opcaios.org/api/v1/posts
Method	What you want to do	GET fetch data, POST create new, PATCH edit, DELETE remove
Header	Information sent along, most important is the authentication key	Authorization: Bearer <key>
Body	Data sent up (when creating or editing)	{"fullName": "Nguyen Van A", "phone": "09…"}
Response	Result returned, usually in JSON format, with status code	200 success, 401 key missing, 429 called too many times

JSON is a data format like "name: value" that both humans and machines can read. For example when calling opcaios.org's API without sending a key, the server returns code 401 with content:

{"success": false, "error": "Missing token. Create token in Admin → Settings → API token."}

API key (token)

API key is like an access card: the server looks at the key to know who is calling and what they're allowed to do. Some keys only read, some keys can write. Whoever holds the key has the rights of the key owner, so API keys must be guarded like passwords.

Rate limit

Rate limit is the limit on how many times you can call an API within a time period so the server doesn't get overloaded. Almost all APIs have this limit. For example opcaios.org's API allows each key maximum 120 calls per minute; exceeding it returns code 429 and you must retry later. With an n8n workflow running every morning, 120 calls per minute is usually enough, but a runaway loop can hit the limit in seconds. So read the documentation page about limits from OpenAI, Google, or Anthropic before running automation, because each provider sets different rates.

How is API different from webhook?

API is you actively asking the other system, while webhook is the other system actively telling you. Asking constantly wastes effort, asking rarely is slow, so you need to tell the two apart:

• API: you ask "are there new orders?" on your schedule.
• Webhook: the other system tells you "just got a new order here", you just need to give them a URL address.

Real example, from opcaios.org's source code (checked 22/10/2026): when a customer transfers money to buy a course, SePay (a service that monitors bank transactions) sends a webhook to the website. The website checks the secret key in the request, matches transaction details with order code, unlocks the course for the customer, and notifies the site owner, so nobody has to sit and reconcile bank statements. Finally, the website returns 200 so SePay knows it received and won't send again.

Where are APIs used in daily work?

APIs are used in four common groups of work, and nearly every automation tool calls at least one of them. First is payment: payment gateways and SePay report paid orders via webhook. Next is sales and customer care: a form on the website sends leads into a CRM, then the CRM sends messages through the API of Zalo OA or email.

• Advertising and reporting: fetch spending data from Meta Ads and Google Ads into Google Sheets every morning.
• AI: applications call APIs from OpenAI, Anthropic or Google to write, summarize, classify. Most AI APIs charge by the amount of text (tokens) sent and received, so you need to set a spending limit from the start.

For example, a small shop can connect an order form to Google Sheets via n8n, so each new order automatically becomes a row in the spreadsheet without anyone having to type it in manually. This example is an illustration by OPCAIOS.

Can I use APIs if I don't know how to code?

Yes, people who don't know how to code can still use APIs thanks to drag-and-drop automation tools, because these tools handle the technical part for you. Three popular tools are:

• n8n: open source, can be installed on your own server, has an "HTTP Request" node to call any API.
• Make and Zapier: online services with thousands of pre-built integrations.

The common approach has four steps. First, choose a trigger event like a new form, an incoming webhook, or 8 AM. Next, add a step to call the API. Then, paste the endpoint and key and link the data with your mouse. Finally, for APIs without pre-built integrations, use the "HTTP Request" step and read the API documentation to learn the endpoint, method, body.

Real example: what endpoints does the opcaios.org API have?

The opcaios.org API is a REST API at https://opcaios.org/api/v1, open to connect with n8n, Make, Zapier or your own scripts. According to the admin of opcaios.org (checked on 22/10/2026), the site owner creates a key and chooses read-only or read-write permissions. Some endpoints:

Method	Endpoint	What it does
GET	/api/v1/posts	List of posts
POST	/api/v1/posts	Create a post (defaults to draft)
GET	/api/v1/submissions	Forms left by customers
POST	/api/v1/contacts	Add a lead to the CRM
POST	/api/v1/links	Create a shortened opcaios.org/go/… link

Try calling it with curl (replace the key with your actual key):

curl https://opcaios.org/api/v1/posts?limit=3 \
  -H "Authorization: Bearer opc_api_xxxxxxxx"

The result always comes back as {"success": true, "data": …} or {"success": false, "error": "…"}, so automation tools can easily check if it succeeded or failed.

How are APIs and MCP different?

MCP is a standard that helps AI assistants use external tools, and the endpoints above also appear in the MCP server of opcaios.org with the same actions. The difference lies with the user:

• API is for software and people writing workflows: you know in advance which endpoint you'll call, in what order.
• MCP is for AI: MCP wraps actions into "tools" with descriptions, so AI assistants like Claude from Anthropic or ChatGPT from OpenAI can choose which to call on their own during conversation.

MCP servers usually call APIs underneath. For example, when you say "create a draft post about webhooks", the assistant calls the MCP tool, and that tool calls POST /api/v1/posts. Read the What is MCP? post to see how these two connect.

Security notes when using APIs

• Don't paste API keys in public places: source code pushed to GitHub, screenshots, group messages, chat frames with AI.
• One key per job, least privilege: if a workflow only needs to read, use a read-only key. If one key leaks, you revoke just that one.
• Webhooks must authenticate: check the secret key or signature in each incoming request, otherwise anyone can fake "order paid".
• Set spending limits for paid APIs: especially AI APIs — a buggy loop can call thousands of times in minutes.
• Keep logs: save each important call so when something goes wrong you know what happened.

Frequently Asked Questions

Do APIs charge fees?

It depends on the provider. Many APIs are free within certain limits, while AI APIs and data APIs usually charge based on usage, such as OpenAI, Anthropic, and Google which all charge by token. Since pricing changes over time, read the official pricing page before connecting to your automation workflow. First set spending limits, then test with a few dozen calls, and only then enable scheduled runs. This post doesn't mention specific pricing because OPCAIOS hasn't verified the providers' rate cards.

What is REST API?

REST is the most common API design approach: each data type has its own address, for example /posts or /contacts, and you use HTTP methods GET, POST, PATCH, DELETE to retrieve, create, edit, delete. For example, opcaios.org's API uses GET /api/v1/posts to fetch the list of posts and POST /api/v1/posts to create a new draft post. Thanks to this consistent naming convention, workflow writers in n8n, Make or Zapier can guess other endpoints without having to learn everything from scratch.

Where do I get an API key?

The API key is in the settings or developer section of the service you want to connect, usually named "API keys", "Developer" or "Integration". With opcaios.org, the site owner creates the key in the admin panel and chooses read-only or read-and-write permissions. A key should only have the minimum permissions needed for one task, and must be kept like a password: never paste it into public source code, screenshots, or AI chat windows.

API or webhook, which should I use?

You need to know right away when an event happens like a new order or payment received, then use a webhook if the service supports it. If you need to fetch or send data on a schedule, or when you take action yourself, then use an API. Most workflows use both: SePay's webhook tells you payment arrived, then your internal API unlocks the course for the customer. This example comes from how opcaios.org handles course orders.

Do I need to learn programming to use APIs?

Not required. With n8n, Make or Zapier, you only need to understand endpoints, methods, keys, and JSON at a reading level, exactly what this post has explained. To learn how to apply AI and automation for small teams, see AI application training course.

Source: source code and real feedback from opcaios.org API (/api/v1, SePay webhook), verified on 22/10/2026.