Automation & AIModule 2: Automation building blocksLesson 8 of 15
Course progress47%
20 min lesson · Updated August 2026
What are APIs, webhooks and integrations?
An API defines supported programmatic requests to a system, a webhook pushes an event to a receiving endpoint, and an integration connects systems by handling authentication, mapping, errors and ongoing change.
What you will learn
By the end, you will understand:
Explain request/response APIs and webhook events
Protect endpoints with authentication and signature validation
Plan versioning, rate limits, mapping and failure recovery
Visual explainer
See the idea clearly.
✓
System A requests data from System B through an authenticated API, while System B pushes a signed event to a webhook endpoint; an integration maps fields and handles errors between them.
API is a contract
An application programming interface describes operations, inputs, authentication and responses that software can use. A client may request a record, create an item or update a status.
The API exposes only what the provider supports. Scraping a screen and relying on hidden fields is more fragile and may violate terms.
Webhook pushes an event
Instead of repeatedly asking “did anything change?”, a system sends an HTTP request to a registered endpoint when an event occurs. The payload identifies the event and relevant data.
Webhooks can arrive late, more than once or out of order. Authenticate the sender, validate the signature over the raw payload as documented, acknowledge quickly and process safely.
Integration handles the messy middle
Concern
Example
Authentication
API key, OAuth token, signed webhook or service identity.
Mapping
Customer email in one system becomes contact.email in another.
Transformation
Dates, currencies, enums and phone formats differ.
Reliability
Retries, queues, idempotency, rate limits and partial failures.
Governance
Permissions, retention, logs, owner, vendor terms and deletion.
Protect webhook endpoints
HTTPS
Unpredictable endpoint where appropriate but not sole control
Signature/secret validation
Timestamp/replay protection
Schema and size limits
No secrets in query string
Fast acknowledgement
Queue for processing
Rate limiting
Safe logs
Rotation plan
Test/live separation
Credentials belong server-side
API keys, client secrets and webhook signing secrets should not be embedded in browser JavaScript, public repositories, shared screenshots or lesson content. Store them in an approved secrets system and grant least privilege.
Rotate compromised credentials and design the integration so rotation does not require editing many workflows manually.
Plan for provider change
01
Read current API/docs
02
Pin supported version
03
Build contract tests
04
Monitor deprecation notices
05
Handle rate limits
06
Stage migration
07
Test representative events
08
Roll out gradually
09
Keep fallback/rollback
No-code does not remove engineering responsibility
A connector can simplify setup but still moves data, uses credentials and depends on vendor behavior. Review what fields leave each system, where they are stored and who can edit the workflow.
Use test accounts/data and avoid giving a connector broad administrator access solely for convenience.
Real-world example
Example: payment webhook without duplicate fulfilment
Example
The payment provider sends a signed event. The server verifies the signature and event ID, stores it, returns a quick acknowledgement and processes fulfilment from a queue. A repeated event finds the same ID and does not ship twice.
Try this
Create an integration contract card
For one connection, record systems, trigger/request, authentication, fields, permissions, rate limit, duplicate strategy, failure alert, owner and deprecation source.
Common questions
Questions beginners ask.
What is an API?
A documented programmatic interface through which software can request supported data or actions.
What is a webhook?
An event message sent by one system to a registered receiving endpoint.
What is an integration?
The connection logic that authenticates systems, maps/transforms data and handles reliability and governance.
Why validate webhook signatures?
To verify the payload came from the expected provider and was not altered, according to its documented method.
Can a webhook arrive twice?
Yes. Design idempotency and event storage to avoid duplicate effects.
Where should API secrets be stored?
In an approved server-side credential/secrets system with least privilege, rotation and access control.
What is a rate limit?
A provider limit on request volume over time; workflows should respect and handle it.
Is a no-code connector automatically secure?
No. Review permissions, data movement, credentials, vendor terms, logs and failure behavior.
