Most businesses now run several cloud systems, and the useful work happens in the gaps between them. API integration services connect those systems so data moves on its own, instead of being copied by hand.
This guide explains what an API integration project involves, what good work looks like, and what to ask before you hire anyone to build it.
Key PointAn integration is an agreement about who owns each record. The code comes after that agreement, not before it.
What an API integration actually is
An API is the published way one system lets another read or change its data. An integration uses those APIs to keep two or more systems in step: a new order in your shop creates a sales order in your finance system, or a paid invoice updates your CRM.
The work is less about code than about agreement: which system owns each record, what happens when the two disagree, and who is told when something fails. Our article on API-first integration explains why we start there.
What good API integration work looks like
A good integration partner does a few things consistently:
- Reads the API documentation first, including limits on how many calls you can make and how results are paged.
- Confirms every transfer, so a failed record is caught rather than silently lost.
- Plans for change. Microsoft's API design guidance explains how versioning lets an API change without breaking the applications that already use it.
- Logs and monitors, so problems reach a person before a customer notices them.
Pro TipAsk to see how a failed transfer is reported. If nobody can show you, failures will be found by customers.
Security is part of the job
An integration holds keys to more than one of your systems, so security is not optional. The OWASP API Security Top 10 lists the most common API risks. Broken object level authorisation and broken authentication sit at the top of the 2023 list.
Many APIs use OAuth 2.0, a standard that lets an application get limited access to a service without sharing a password. Ask how the integration will store and rotate its credentials, and who can see them.
Watch OutNever let integration credentials sit in a shared spreadsheet or an email. Ask where they are stored before work starts.
Personal data and contracts
If the integration moves personal data, such as customer names and addresses, the company building and running it may be processing that data for you. The ICO explains what a contract between a controller and a processor must cover. That includes acting only on your documented instructions, confidentiality, security and the use of sub-processors.
Questions to ask before you hire
- Which system will own each type of record, and what happens when two systems disagree?
- How will we know when a transfer fails, and who is told?
- How do you handle API limits and changes to an API's version?
- Where are the credentials stored, and who can see them?
- What will you hand over, so we are not dependent on you?
These sit alongside the wider checks in our guide to choosing a systems integration company. For the budget side, read what an integration actually costs.
Next steps
If your systems do not talk to each other, our guide to why that happens and what to do about it is a good place to start. Our integration service starts by reading the APIs: before we quote, we connect to your systems and find out what they will actually give us. Get in touch to talk it through.
Lee Nash is a business systems consultant and co-founder of Amplio Systems.