An API link is usually an endpoint URL: the address a web application requests to read data or perform an action. The URL is only one part of the call. The client also needs the correct HTTP method, headers, authentication, query parameters, and sometimes a request body. The server validates that request and returns a response, commonly JSON.
There is a second meaning of “API link.” An API response can contain links to the current resource, related resources, or permitted actions. An endpoint is where your code sends a request; a response link is information the server sends back for possible next requests. Keeping those meanings separate makes API documentation, browser code, and troubleshooting much easier.
What an API link actually identifies
Consider the illustrative endpoint https://api.example.com/users/123. Its scheme (https) selects encrypted HTTP, the host identifies the API server, and the path identifies a user resource. A client might send a GET request there to retrieve user 123.
The URL does not, by itself, specify every requirement. An API may require a bearer token, an Accept header, query parameters, or a JSON body. The same path can support several operations through different methods:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
| Method | Typical purpose | Example |
|---|---|---|
GET |
Read a representation | GET /users/123 |
POST |
Create a resource or start an operation | POST /users |
PATCH |
Partially update a resource | PATCH /users/123 |
DELETE |
Remove a resource | DELETE /users/123 |
These conventions are common, not guarantees. Always follow the particular API’s documentation. OpenAPI describes paths, operations, parameters, request bodies, responses, and security requirements in a machine-readable format. It is a description used for documentation, code generation, and testing; it is not the live endpoint itself.
Endpoint URL versus a link in an API response
An endpoint is an address your application already knows or constructs. A response link is data returned by the server. Hypermedia APIs commonly represent a link with an href URI and a rel value that explains the relationship.
{
"id": 123,
"name": "Ari",
"links": [
{ "rel": "self", "href": "/users/123" },
{ "rel": "orders", "href": "/users/123/orders" }
]
}This JSON is illustrative, not a tested service response. A self link identifies the current resource; an orders link suggests a related collection. An API might instead return plain data with no links at all. REST does not require every response to include navigational links.
Some specifications also describe relationships in documentation. For example, an OpenAPI Link object can explain how one operation’s output supplies parameters to another operation. That documentation relationship does not require the production response to contain a link. Similarly, HTTP link headers and links embedded in a JSON body are different mechanisms.
Recommended Free Tools
How a web application follows an API link
- Choose the server and path. Configuration usually supplies a base URL such as
https://api.example.com; application code adds an endpoint path. - Build the request. Select the method, encode query parameters, set headers, and serialize a body when required.
- Send it over HTTP. The browser, server runtime, or mobile client resolves the URL and makes the request.
- Authenticate and authorize. The API checks credentials and whether that identity may perform the operation.
- Interpret the response. Code checks the status, parses the representation, and handles errors before updating the interface.
- Follow returned links when appropriate. A client can resolve a relative
hrefagainst the response URL or documented base URL, then make the next permitted request.
A relative URL is not incomplete by definition. In an OpenAPI document, a relative server or path reference is resolved against the applicable server base URL. Your client should use the API’s documented base rather than assuming that a link belongs to your own website.
Calling an API from browser JavaScript
Modern browser code commonly uses fetch. This example sends a public illustrative request and handles both HTTP errors and malformed JSON:
Rank #2
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
async function loadUser(id) {
const url = `https://api.example.com/users/${encodeURIComponent(id)}`;
const response = await fetch(url, {
method: "GET",
headers: { "Accept": "application/json" }
});
if (!response.ok) {
throw new Error(`API returned ${response.status}`);
}
return response.json();
}
loadUser(123)
.then(user => console.log(user))
.catch(error => console.error("Request failed", error));If the API requires a token, send it only as the provider documents. A short-lived token intended for browser use might be placed in an Authorization header:
fetch("https://api.example.com/profile", {
headers: {
"Accept": "application/json",
"Authorization": `Bearer ${accessToken}`
}
});Do not put a long-lived private server credential in frontend JavaScript. Anything delivered to a browser can be inspected by the user. Put privileged calls behind your own server, where the secret remains private.
CORS can block an otherwise valid URL
Cross-origin resource sharing (CORS) is a browser security rule. If your page is hosted at https://app.example.com and calls https://api.example.com, the API must return headers permitting that origin. A command-line request may work while browser JavaScript is blocked because a command-line client does not enforce browser CORS rules.
For requests that trigger a CORS preflight, the browser first sends an OPTIONS request. The server must allow the origin, method, and requested headers. Configure this on the API or its gateway; adding a frontend header cannot override a server policy. WordPress.com’s browser API guidance, for example, documents origin whitelisting and token-based requests for this reason.
Authentication, permissions, and status codes
A reachable URL does not grant access. APIs commonly use API keys, OAuth access tokens, signed requests, cookies, or mutual TLS. Authentication answers “who are you?” Authorization answers “what may you do?”
| Status | Meaning for a client | What to check |
|---|---|---|
200 |
Successful response | Parse the representation. |
201 |
Resource created | Read the returned resource or Location information. |
204 |
Success with no body | Do not call JSON parsing on an empty response. |
400 |
Invalid request | Check parameters, JSON shape, and content type. |
401 |
Authentication missing or invalid | Refresh or supply the required credential. |
403 |
Authenticated but not permitted | Check the account’s role and scope. |
404 |
Resource or route not found | Verify the base URL, path, identifier, and API version. |
429 |
Rate limit exceeded | Honor retry guidance and reduce request frequency. |
5xx |
Server-side failure | Retry safely when the operation is idempotent and investigate logs. |
Returned action links can also be permission-dependent. An API may include an update link only when the authenticated user can update that resource. Never treat the presence of a URL as proof that a caller may use it, and never assume copying a link bypasses access control.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
Query strings, bodies, and URL encoding
Query parameters after ? commonly control filtering, sorting, pagination, or field selection:
https://api.example.com/articles?status=published&limit=20Encode values rather than concatenating raw user input. In JavaScript, URLSearchParams handles spaces and reserved characters:
const params = new URLSearchParams({ search: "API links", limit: "20" });
const response = await fetch(`https://api.example.com/articles?${params}`);Use a request body for data the API expects in the payload, usually with Content-Type: application/json. Do not put passwords or tokens in query strings unless the provider explicitly requires it; URLs can appear in browser history, proxy logs, analytics, and referrer data.
Relative links, pagination, and client design
Pagination is a practical reason to consume response links. A response may provide a next URL that already contains the provider’s cursor and filter state. Following that URL is safer than reconstructing pagination rules yourself:
async function getAllPages(firstUrl) {
const records = [];
let next = firstUrl;
while (next) {
const res = await fetch(next, { headers: { Accept: "application/json" } });
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const page = await res.json();
records.push(...(page.items || []));
next = page.links?.find(link => link.rel === "next")?.href || null;
if (next && !new URL(next, res.url).protocol.startsWith("http")) {
throw new Error("Unexpected link scheme");
}
next = next ? new URL(next, res.url).toString() : null;
}
return records;
}Validate schemes and, where necessary, allowed hosts before following server-provided URLs. This reduces the risk of an API response redirecting a client to an unintended destination. Also define limits, cancellation, and retry rules so a broken pagination link cannot create an endless loop.
OpenAPI: the map, not the destination
An OpenAPI document can tell developers which server base URL, paths, methods, parameters, schemas, responses, and security schemes an API declares. Documentation tools render it as reference material; generators can create client models; testing tools can exercise documented operations.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
Still, the document may be stale, may describe several server environments, or may use relative references. Confirm the selected server, API version, and authentication instructions. A generated client does not remove the need to handle timeouts, errors, permissions, CORS, and response changes.
Common failures and precise fixes
“The URL works in curl but not in the browser”
Most often this is CORS. Inspect the browser console and the network panel for the preflight and response headers. Ask the API operator to allow the exact page origin and required methods and headers. Do not solve it by disabling browser security for production users.
401 Unauthorized
Check that the credential is present, unexpired, correctly prefixed (for example, Bearer), and intended for this API environment. Verify clock skew for signed requests. A login cookie may also require the appropriate credentials setting and server-side cookie policy.
403 Forbidden or a missing action link
The identity is recognized but lacks the required role, scope, ownership, or subscription. Compare the account’s permissions with the operation documentation. Do not keep retrying; authorization failures are not transient network errors.
404 Not Found
Check for a missing API version segment, a wrong region or environment, URL encoding errors, and an identifier that belongs to a different account. Some services intentionally return 404 for resources the caller is not allowed to discover.
OPTIONS or preflight failure
A custom header, non-simple content type, or method can trigger preflight. Ensure the server answers OPTIONS with matching Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers values. Keep allowed origins narrow.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →JSON parsing fails
Log the status and Content-Type before parsing. Error pages, redirects, empty 204 responses, and proxy messages are not JSON. Read text first when diagnosing an unexpected body, and check whether a redirect changed the request’s authentication context.
Timeouts, duplicate writes, and retries
Set an abort timeout in the client. Retry only when the operation is safe to repeat or the API supports an idempotency key. A network timeout does not prove that the server did not process a write; query the resource or use the provider’s idempotency mechanism before submitting it again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reliability, security, and maintainability checklist
- Keep the API base URL configurable for development, staging, and production.
- Use HTTPS and avoid secrets in URLs, source control, logs, and client bundles.
- Validate response status, content type, schema, and pagination links.
- Use request cancellation, bounded retries, exponential backoff, and rate-limit handling.
- Log correlation IDs and sanitized failure details, not access tokens or personal data.
- Pin or review API versions and monitor deprecation notices.
- Allow only trusted origins and destinations when following browser or hypermedia links.
- Test authentication, permission changes, empty responses, malformed data, and server errors.
Or skip the browser setup: call a screenshot API endpoint
The same endpoint principles apply when your application needs a website image. ScreenshotNeo is a website screenshot API and MCP server. Its request URL is https://api.screenshotneo.com/v1/shot; send your access key and target URL as parameters.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);See the ScreenshotNeo documentation for parameters and response details. Before capture, it can accept cookie or consent banners and remove more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers report the page verdict and billing status. It also provides an MCP server with take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Plans include 1,000 screenshots per month free with no card. Paid plans start at $5 for 3,000 shots; every feature is included on every plan. Create a free ScreenshotNeo account.
Frequently Asked Questions
Does every API URL return JSON?
No. An endpoint can return JSON, HTML, a file, a PDF, or an empty response. Check the API documentation and the response Content-Type before parsing.
Can I call any API directly from frontend JavaScript?
Only when the provider supports browser access, returns suitable CORS headers, and offers a browser-safe authentication flow. Keep private server credentials on your backend.
Is an OpenAPI URL the same as an API endpoint?
No. An OpenAPI document describes available operations. The live endpoint is the URL that receives the HTTP request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
