Step 2 of 7
APIs: REST and GraphQL
An API is the menu your server offers. REST uses URLs and HTTP verbs (GET /listings/42). GraphQL lets the client ask for exactly the fields it needs from one endpoint.
Why it matters when you build with AI: Every API endpoint is a public door. Check who's allowed through on the server, never only in the UI.
Quick check
Where must an API check who's allowed?
Anyone can call your API directly. The server must enforce access.