Why APIs Matter
Modern enterprises are no longer collections of isolated applications — systems constantly talk to other systems. Entra ID talks to applications. HR platforms provision users into identity systems. Security products send alerts to SIEM platforms. Mobile apps talk to authentication servers. Banking apps talk to payment systems. Cloud applications talk to AWS, Azure and Google Cloud. ITSM platforms like ServiceNow integrate with hundreds of other systems. Identity platforms provision accounts via SCIM. SOC automation isolates endpoints through security-product APIs. DevOps pipelines build infrastructure through cloud APIs.
In many enterprise environments, "the integration isn't working" ultimately means an API request is failing somewhere in that chain. An engineer who understands HTTP, JSON, authentication, tokens, status codes, headers, logs and tools like Postman can investigate these problems far more effectively than someone who only understands the graphical interface sitting on top of it all.
Learning Objectives
By the end of this module (all 6 lessons), you should be able to explain what an API is and how client/server architecture works; understand REST, HTTP methods, JSON, headers and query/path parameters; recognise HTTP status codes and diagnose 401/403/404/5xx failures methodically; understand bearer tokens, access/refresh tokens, JWTs, OAuth 2.0 flows, mTLS and other API authentication mechanisms; use Postman and curl to test and troubleshoot APIs, and parse JSON with jq or PowerShell; recognise SOAP/XML APIs, GraphQL, gRPC, webhooks, API gateways and OpenAPI; and troubleshoot a real, multi-layer enterprise API integration from first principles.
1 What Is an API, and Why Do IT Professionals Need It?
API stands for Application Programming Interface — it lets one software system communicate with another. A human uses an employee-management application through a browser: Browser → Employee Portal → Application Server → Database. But another application that needs the same information doesn't need to open a website and click buttons — it can talk to the API directly: HR Application → Employee API → Database. A request like GET /api/users/12345 gets a JSON response back describing that user, which the requesting application can process automatically.
API knowledge is sometimes treated as something only developers need — that's wrong. A Help Desk engineer might investigate why an app receives 401 Unauthorized retrieving user info. An IAM engineer might troubleshoot Entra ID's SCIM provisioning to a SaaS app that's stopped working. A SOC analyst might call GET /api/v1/security/events to pull alerts. A security engineer might call POST /api/endpoints/12345/isolate to contain a compromised laptop (Module 12). A cloud engineer's AWS Console, CLI, Terraform and boto3 scripts are all just different ways of talking to the same underlying AWS APIs — the console is one interface among several, not the "real" way to do it.
2 Client, Server & the API Endpoint
Most APIs involve two components: the client initiates a request, the server processes it and returns a response.
CLIENT ------ HTTP Request -----> SERVER
CLIENT <----- HTTP Response ------ SERVERClients might be web browsers, mobile apps, PowerShell, Python scripts, Postman, curl, cloud applications, identity platforms, monitoring software, SIEM systems, or even other APIs. Servers might be web servers, application servers, identity services, cloud services, database-backed applications, microservices, or API gateways.
An endpoint is a specific location an API exposes, e.g. https://api.example.com/v1/users/12345 — break it apart: https:// is the protocol, api.example.com the hostname, /v1/ often the API version, users the resource, 12345 a specific resource identifier. GET https://api.example.com/v1/users/12345 means: retrieve information about user 12345.
Lessons in This Module
Work through these in order — each builds on ideas from the last. Every lesson has its own "Mark lesson complete" button; your progress across all six is tracked below.
REST vs HTTP, the anatomy of a request and response, all five core HTTP methods, idempotency, and reading JSON.
Content-Type, correlation IDs, query/path parameters, and every status code that actually matters for troubleshooting.
Basic Auth, API keys, bearer tokens, OAuth 2.0 flows, JWTs, opaque tokens, mTLS, HMAC signing, and Kerberos/NTLM.
Postman, curl, jq and PowerShell for real API work, plus pagination, rate limiting, versioning and OpenAPI/Swagger.
API gateways, WAFs, reverse proxies, timeouts, SOAP/XML, GraphQL, gRPC, webhooks, SCIM, and API security.
The 9-step API troubleshooting method, hands-on labs, common mistakes, a mini incident project, and a final capstone challenge.