An API, or application programming interface, is a published way for one piece of software to ask another for information or to have it do something. When your website form creates a contact in your CRM, or a dashboard shows this month’s invoices next to your marketing results, an API is almost always doing the work.

When we first wrote about APIs in 2018, the point was that no company can specialize in everything. APIs let us plug into services built by companies that have spent years on one problem, instead of rebuilding them from scratch. That is still true. What has changed is that APIs now also set the limits of what an AI agent can see and do.

How an API works, in plain terms

An API is a set of requests a system agrees to answer. A program sends a request, such as “give me customer 1042” or “create an invoice for this order,” and the system sends back a response, usually as structured data. Most modern web APIs work over HTTPS and exchange data as JSON, a simple text format both people and programs can read.

  • Authentication: the system needs to know who is asking. Simple APIs use a secret key. Many use OAuth, which lets a person grant an application access without sharing their password, limited by scopes such as “read contacts” but not “delete contacts.”
  • Rate limits: most APIs cap how many requests you can make in a period, which shapes how an integration is designed.
  • Webhooks: instead of asking a system over and over whether anything has changed, a webhook lets the system notify you the moment something happens, such as a new order or a signed contract.
  • Documentation and sandboxes: good APIs come with clear documentation and a test environment, so integrations can be built without touching live data.

What APIs make possible for a business

  • One view across systems. Dashboards that combine data from analytics, accounting, and CRM tools, such as Google Analytics, QuickBooks, HubSpot, or Salesforce, without anyone exporting spreadsheets.
  • Data that moves on its own. A website inquiry becomes a CRM contact, which becomes a quote in the ERP, with no retyping in between.
  • Capabilities you don’t have to build. Payments, maps, email delivery, document signing, and AI models are all available as services you connect to rather than software you write.
  • Your own systems, opened to partners. An API can give partners or members controlled access to your data. We built one for the U.S. Chamber of Commerce’s financial dashboard.

Why APIs decide what an AI agent can do

An AI agent does not reach into your systems by itself. It works through tool calling: the model decides that it needs, say, an order’s status, and code you control makes the matching API request and hands back the result. So the agent can only see and do what the connected APIs, and the permissions you grant them, allow.

That is a feature. It means an agent’s reach is something you design, not something you hope about:

  • Give the agent the narrowest access that does the job. An agent that answers order questions needs to read orders, not edit them.
  • Require a person’s approval before writes that matter, such as refunds, price changes, or anything a customer will see. We call this human in the loop.
  • Log every call the agent makes, so you can see exactly what it looked at and what it changed.
  • Plan for rate limits, timeouts, and errors, so a slow system produces a clear handoff rather than a wrong answer.

You will also hear about the Model Context Protocol (MCP), an open standard introduced by Anthropic in late 2024 for connecting AI applications to tools and data. A growing number of software vendors publish MCP servers for their products. MCP standardizes how an agent discovers and calls tools, but underneath it is still the same APIs and the same permissions, so the questions below still apply.

Questions to ask about each system before an integration or agent project

  • Does it have an API, and is it included in your plan? Some vendors only offer API access on higher tiers.
  • Can it read and write the records you care about, or only some of them?
  • How does access work: OAuth with scopes, or a single key that can do everything?
  • What are the rate limits, and does it offer webhooks for changes?
  • Is there a sandbox, and does the system keep an audit log of API activity?
  • If there is no API, what is the fallback: scheduled exports, email parsing, or, as a last resort, automating the screen a person would use?

Where we come in

Most of our work connects systems clients already run: ERPs, CRMs, SharePoint, websites, and SaaS tools. We build the integrations, the custom APIs, and the AI agents that work through them, with the permissions and review steps designed in from the start. See our web development work, or tell us which systems you need to connect.