How APIs Work — The Request-Response Cycle Explained

In this tutorial, you will learn about How APIs Work. We cover key concepts, practical examples, and best practices to help you master this topic.

APIs work through a request-response cycle where a client sends an HTTP request to a server, the server processes it and sends back a response containing the requested data or operation result.

What You'll Learn

• The complete lifecycle of an API call from client to server and back
• How HTTP methods, headers, and status codes work together
• What happens behind the scenes when your app makes an API request

Why It Matters

Understanding how APIs work helps you debug integration issues, optimize performance, and design better APIs. DodaTech's Durga Antivirus Pro processes millions of API calls daily for threat intelligence — every millisecond counts.

sequenceDiagram
    Client->>API: HTTP Request (GET /threats)
    API->>Database: Query threats
    Database-->>API: Results
    API-->>Client: HTTP Response (200 OK + JSON)
    Note over Client,API: Request-Response Cycle

Real-World Use

When the Durga Antivirus Pro app checks for new virus definitions, it sends GET https://api.durga-antivirus.com/v1/definitions/latest. The API server authenticates the request, queries the database for the latest definitions, and returns them as JSON. The app downloads and applies the updates.

Code Examples

# Curl example showing the full request-response cycle
curl -v https://jsonplaceholder.typicode.com/posts/1

Expected output includes request headers and response with status code:

> GET /posts/1 HTTP/1.1
> Host: jsonplaceholder.typicode.com
< HTTP/1.1 200 OK
< Content-Type: application/json
{"userId": 1, "id": 1, "title": "...", "body": "..."}

import requests

response = requests.get(
    "https://api.github.com/users/octocat",
    headers={"Accept": "application/vnd.github.v3+json"}
)
print(f"Status: {response.status_code}")
print(f"Headers: {dict(response.headers)}")
print(f"Body: {response.json()}")

Expected output:

Status: 200
Headers: {'content-type': 'application/json', 'x-ratelimit-limit': '60', ...}
Body: {'login': 'octocat', 'id': 583231, ...}

Common Mistakes

1. Ignoring Response Headers

Headers contain critical info like rate limits, Caching rules, and content type.

2. Not Checking Status Codes

Always check 200, 201, 400, 401, 404, 500 before Parsing the response body.

3. Forgetting Authentication Headers

Many API failures are simply missing or expired auth tokens.

4. Hardcoding API URLs

API base URLs change between environments (dev, staging, production).

5. Blocking the Main Thread

Synchronous API calls freeze the UI. Use async patterns in production apps.

Practice Questions

1. What are the four main parts of an HTTP request?
2. What status code indicates a resource was created successfully?
3. How does a client know the response format?
4. What is the purpose of the Authorization header?
5. Why should API calls be made asynchronously in mobile apps?

Answers:

1. HTTP method, URL, headers, body.
2. 201 Created.
3. From the Content-Type header in the response.
4. To prove the client's identity to the server.
5. To prevent blocking the UI thread, which would freeze the app.

Challenge: Use curl to trace the full request-response cycle of any public API. Show the request headers sent and the response headers received.

FAQ

What's Next

Learn about the Client-Server Model in detail, then explore API Protocols like REST, Graphql, and gRPC.