REST API

What it means

A REST API is the most widespread style of web interface through which systems exchange data using standard HTTP requests, usually in JSON format. Every resource, such as an invoice or a customer, has its own address, and data are handled through read, create, update and delete operations.

It is a specific form of API that caught on thanks to its simplicity and independence from programming languages. REST APIs connect an online shop with accounting software, a bank with a corporate system, a CRM with an email tool or an invoicing app with a payment gateway.

Security comes from an encrypted connection and access verification, for example with an API key or token. REST APIs are often complemented by a webhook, through which a system announces an event itself, such as an invoice being paid, instead of the other system having to keep asking.

How it works in practice

When choosing accounting or invoicing software, check whether it has a documented REST API and what it can do. Integrating an online shop with accounting through the API removes manual retyping of orders and invoices and reduces errors.

The integration should be designed by someone who understands both systems and the accounting rules. It is important to decide which system is the source of truth for each piece of data, how errors and duplicates are handled and how changes are tested before going live.

With banks, REST APIs are used under open banking to download statements or initiate payments. An accounting firm can then receive account movements automatically and match them with invoices without waiting for the monthly statement.

What to watch out for

API keys and tokens are like passwords. If they end up in public code, an email or a spreadsheet, anyone can access the data. Keys must be stored securely, carry only the permissions needed and be rotated immediately if a leak is suspected.

Interfaces evolve and older versions are switched off. An integration nobody looks after can stop working overnight. Watch the provider's announcements, log errors and have someone clearly responsible for maintaining the connection.