What is API?

A web API call is a method and a path, sometimes with a body: GET to read, POST to create, PATCH or PUT to update, DELETE to remove. The status code carries the outcome. 2xx means the request was accepted, 401 means the credential was missing or wrong, 403 means it was valid but not permitted, 404 means the resource does not exist, and 429 means you have exceeded a rate limit, usually with a Retry-After header telling you how long to wait. REST is the common style; GraphQL sends one query document to a single endpoint, and gRPC moves binary messages over HTTP/2.

Authentication is normally a token in a request header, either Authorization: Bearer followed by the token or a vendor-specific key header. Some APIs sign each request with an HMAC over the body and a timestamp, which prevents replay. Keep keys in environment variables or a secrets manager, never in the repository, and issue separate keys per environment so revoking one does not stop production. A 407 Proxy Authentication Required response is a different failure from 401: it comes from the proxy in front of the request, not from the API behind it.

Proxy control APIs tend to cover the same ground: list your endpoints, force a rotation, choose a country or carrier, read the GB consumed, create sub-users. Some providers put those controls in the proxy username string instead of a REST call, so a session or a geo target is encoded where credentials go. Check which model you are dealing with before designing worker code, because one implies an HTTP client and the other implies string templating. At PROXIES.SX, endpoints and rotation carry no charge, so a rotation loop costs nothing beyond the traffic it moves.

Consuming an API without pain comes down to a handful of habits. Set an explicit timeout on every call, because a hung socket blocks a worker indefinitely. Retry 429 and 5xx responses with exponential backoff plus jitter, and never retry a 400. Send an idempotency key on writes so a retried purchase does not run twice. Page with cursors rather than offsets where both exist. Pin the version in the path, subscribe to the changelog, and log the request identifier from each response so support can trace a failed call.