API (Application Programming Interface)

A hosting API lets your own code ask the server to do something instead of clicking through a panel. One side sends a request, the other returns a response, usually JSON. There is no screen and no button, just HTTP carrying a credential.

What a request looks like

A correct request has four parts: an endpoint, a method, an authentication header, and for POST or PUT a body. The endpoint is a URL such as https://api.provider.com/v1/domains. The method sets the action: GET reads, POST creates, PATCH changes part of a record, DELETE removes. Credentials belong in the Authorization header, not in the query string.

curl -i "https://api.provider.com/v1/domains" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json"

The -i flag makes curl print response headers instead of only the JSON body, so the status code and the rate-limit headers stay visible. Content-Type tells the server which format you are sending. If the docs provide an example, copy one full request and change the parameters instead of writing it from scratch.

Reading status and headers

Success uses 200 for a read, 201 for a created resource, and 204 when there is no body. Failures: 400 means a malformed payload, 401 an unknown token, 403 a valid token without permission, 404 a missing object, 429 too many calls, and 5xx trouble on the server. Rate limits live in headers, not the body: look for X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. When Remaining hits 0, wait for the reset window instead of retrying, because your IP can get blocked too.

Where APIs earn their keep

APIs help when work repeats. Pointing many DNS records, pulling SMTP status, or creating mailboxes runs faster as a script than by hand in cPanel. Deploys work the same way, one push triggers a rebuild. If the API is your own endpoint, every call spends CPU and sometimes entry processes. When a browser is the caller, the limit is set by CORS, not just the token.

What can hide a failure

Two traps. First, a 200 does not always mean success: plenty of APIs return that code with an error object inside the body, so read the JSON rather than stopping at the status. Second, a response can come from CDN cache instead of the origin. If you change data, call the same endpoint, and still see the old value, the edge answered, not your server.

FAQ