APIs for Finance Teams Explained: REST, OpenAPI and Open Banking

An API (application programming interface) is an agreed way for one piece of software to ask another for data or to make something happen. When your bank feed updates your ledger, when an expenses tool pushes entries to your accounting system, or when a reporting tool pulls numbers from an ERP, an API is usually involved. This guide explains the terms finance teams hear most often: REST, endpoints, requests and responses, OpenAPI, and the open banking idea behind regulated access to payment accounts. It stays at concept level, and it avoids claims about any vendor's products.

APIs are one route to automation, and not the only one. If you are comparing approaches, our guide to robotic process automation in accounting and finance sets out the other main option.

The basics: endpoints, requests and responses

Microsoft's Azure Architecture Center page on RESTful web API design (footer dated 2025-05-08) describes a RESTful web API as one that uses Representational State Transfer principles "to achieve a stateless, loosely coupled interface between a client and service". In plain terms:

• A resource is any object, data or service the client can access, identified by a URI (web address). The page's illustrative address is https://api.contoso.com/orders/1.
• An endpoint is the address you send a request to. The page recommends nouns, not verbs, in addresses: use /orders rather than /create-order.
• A request uses an HTTP method to say what you want to do, and the service returns a response with a status code and, usually, data in a format such as JSON.

The page describes the main methods like this: GET retrieves a representation of the resource; POST is used to add a new resource to the collection that the URI identifies; PUT is used to update an existing resource, with a request body that contains a complete representation of the resource; PATCH performs a partial update to an existing resource; DELETE removes the resource at the specified URI. It adds that PUT requests must be idempotent, meaning that submitting the same request more than once leaves the resource with the same values.

Status codes tell the caller what happened. The page lists, for example, 200 OK, 201 Created, 204 No Content, 400 Bad Request, 404 Not Found and 409 Conflict. It also says RESTful APIs use a stateless request model, so each request is independent and state lives in the resources.

An illustrative example

This example is fictional and uses a made-up address. Imagine a supplier-invoice service at https://api.example.com/invoices. A GET request to /invoices/1042 would ask for invoice 1042 and might return a 200 response with its details, or 404 if no such invoice exists. A POST to /invoices would ask the service to create a new invoice. The point for a finance reader is that each action is a defined request with a defined response, which makes it possible to log and test. How any real service names its endpoints and fields is described in that service's own documentation.

Authentication in outline

Most APIs need to know who is calling. The Microsoft page shows, in its multitenancy discussion, a request header of the form Authorization: Bearer followed by a token. The OpenAPI specification describes how an API declares its security arrangements using securitySchemes and security. This guide does not set out the individual authentication methods, so follow the provider's documentation. Our suggestion for finance teams is to treat API credentials like bank passwords: store them in a managed secrets tool, give each integration its own credential with only the access it needs, and remove it when the integration ends.

What OpenAPI is

The OpenAPI Initiative describes the OpenAPI Specification as "an open standard for describing your APIs". It is a specification language for HTTP APIs, written in YAML or JSON, and not tied to a particular programming language. The specification text (version 3.1.1, dated 24 October 2024) says it "defines a standard, language-agnostic interface to HTTP APIs". The OpenAPI Initiative's learning pages say an OpenAPI description can cover:

• paths (the endpoints an API exposes) and their responses;
• HTTP methods and operations, with parameters and request bodies;
• schemas that define the structure of message content;
• reusable components;
• security schemes; and
• documentation, examples and servers.

The OpenAPI site's "What is OpenAPI?" page says the format supports sharing API designs, generating code, configuring gateways, powering developer portals and driving tests. A newer version of the specification, 3.2, is referenced on the learning pages, so check which version a supplier uses.

For a finance team, the practical value is that an OpenAPI description is a precise, machine-readable list of what an integration can do. When a supplier says "we have an API", asking for the OpenAPI document (if they have one) is a good way to see exactly which fields and actions exist before you commit to a project.

Open banking and PSD2

The Central Bank of Ireland's PSD2 overview says the revised Payment Services Directive opens the market to new provider types, naming Payment Initiation Service Providers and Account Information Service Providers. The page says these providers can compete with banks by offering regulated services such as account information aggregation and payment initiation, and that PSD2 was implemented in Ireland through the European Union (Payment Services) Regulations 2018. The Central Bank page does not use the term "open banking" or describe the technical access arrangements, and it shows no publication or last-updated date.

The Directive's own text on EUR-Lex (Directive (EU) 2015/2366, Article 4) defines a payment initiation service as "a service to initiate a payment order at the request of the payment service user", and an account information service as "an online service to provide consolidated information on one or more payment accounts". This guide does not summarise the access rules in the later Articles.

Our guide to PSD3 and open banking for finance teams covers possible changes, and you should check the current position before relying on any description of the existing regime.

Why data quality matters for any API integration

An API moves data faster; it does not make that data correct. If supplier names are inconsistent or dates arrive in different formats, an integration can spread errors quickly. Our guide to financial data quality management covers the checks to put around data before and after it moves between systems. Our suggestion: agree who owns each field, test with a small sample first, and reconcile totals between the two systems after every run.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is REST the same as an API?

No. An API is the general idea of a defined way for software to communicate. REST is an architectural style that many web APIs follow, as described in Microsoft's design guidance.

Is OpenAPI a type of API?

No. OpenAPI is a specification for describing HTTP APIs, written in YAML or JSON. It documents an API; it does not provide one.

What do PISP and AISP mean?

They are Payment Initiation Service Providers and Account Information Service Providers, the two provider types named on the Central Bank of Ireland's PSD2 page.

Do I need to write code to use an API?

Not always. Some tools hide the API behind a user interface, but understanding the concepts still helps you ask suppliers the right questions.

When you next evaluate a finance tool, ask what its API offers and how it is documented.