API glossary — AIAPI

API — Application Programming Interface

An Application Programming Interface defines how software can use another component’s capabilities. A web API usually documents operations, inputs and responses.

Caveat: API access is not a finished user interface or an automatic integration with your business systems.

Endpoint — API operation address

An endpoint is the address at which an API operation is available. For HTTP APIs, read the path together with the method, such as GET or POST.

Caveat: a base URL is only the starting address. Appending a documented path twice can produce a different, invalid address.

Request — message to a server

A request is the message a client sends to ask a server to perform an operation. It carries a method, a target and headers, and sometimes a body.

Caveat: sending a request does not prove it succeeded. Repeating a request that changes state may repeat the effect.

Response — reply from a server

A response is the server’s reply, including an HTTP status, headers and any response body. Its documented fields explain the result.

Caveat: HTTP 200 does not certify an AI answer’s truth. Check the expected fields, completion state and meaning.

JSON — text-based data interchange

JSON represents structured data using objects, arrays, strings, numbers, booleans and null. Object names and strings use double quotes.

Caveat: valid syntax does not guarantee the right schema. The number 2 and the string "2" are different types.

Authentication — checking identity

Authentication establishes the identity of a caller or validates the credential presented. A service may authenticate an application using an API key.

Caveat: authenticating your backend does not identify each of your end users. Your application needs its own user checks.

Authorization — checking permission

Authorization determines which resources and operations a caller may access. It is distinct from proving identity.

Caveat: a valid credential does not grant every permission. Enforce record-level and action-level checks on the server, not through a model prompt.

API key — an access credential

An API key is a credential associated with service access. For a confidential server API, possession of the key may enable requests under its permissions and usage account.

Caveat: this key is not a text token used for model billing. Keep confidential keys server-side and revoke them if exposed.

Token — a unit of model text

In language-model processing, a text token is a unit produced by a tokenizer. It may represent a character, part of a word or a whole word.

Caveat: Georgian word counts do not directly determine token counts. Measure with the selected model’s tools or usage output, not an English-language shortcut.

Context window — a model’s token capacity

The context window limits how much tokenized material a model can consider in a request. Input, conversation history and output allowance may share a budget; check the model’s specific limits.

Caveat: a large context window is not permanent memory or a promise to find every fact in a long document.

Rate limit — activity allowed over time

A rate limit restricts activity over a time interval, often by request count or token volume. HTTP 429 indicates that the caller has sent too many requests within the applicable limit.

Caveat: available balance does not remove rate limits. Honor Retry-After when supplied and use bounded retries rather than an endless loop.

Streaming — incremental response delivery

Streaming delivers a response incrementally rather than waiting for the whole body. Server-sent events, or SSE, are one event-stream format; not every streaming API uses the same framing.

Caveat: a network chunk need not be a complete event or JSON object. Use the documented parser and treat an interrupted stream as incomplete.

Idempotency — repeat without extra intended effects

An operation is idempotent when repeating the same request has the same intended server-side effect as performing it once. This concerns the effect, not necessarily identical response bodies.

Caveat: POST is not inherently idempotent. An idempotency key prevents duplicate effects only when the receiving service implements that contract.

Gateway — an intermediary service

A gateway receives requests and forwards them to other services. In an AI integration it can provide a shared entry point for upstream model requests, with behavior determined by its configuration.

Caveat: a shared gateway does not make model features identical or generated answers reliable without validation.

Primary sources and further reading

The explanations above are written by AIAPI. These primary sources document the underlying concepts; their inclusion does not imply a partnership.

Found an unclear explanation or an error? Contact [email protected].