An API is a defined interface through which two software systems exchange data, and an API integration is the connection which uses the interface, for example between a webshop and accounting software. In 2026, VirtuoLab indicates €1,500 to €4,000 for a simple integration, €5,000 to €15,000 for a custom REST API and €15,000 to €30,000 for a complex integration layer. First, most business links use REST, webhooks or a vendor format such as the AFAS connectors. Second, security comes before features: broken object level authorization is risk number 1 in the OWASP API Security Top 10 of 2023. API-first work is mainstream as well, because 82% of organisations had adopted some level of an API-first approach in 2025, according to Postman. Finally, VirtuoLab builds every integration in-house with Node.js and TypeScript, and the client owns the code.
What is an API?
An API, short for application programming interface, is a contract which defines how one piece of software asks another piece of software for data or actions. The contract names the endpoints, methods, data format and authentication. For example, a webshop sends a POST request with order data, and the accounting package answers with an invoice number and HTTP status 201. The OpenAPI Specification defines a standard, language-agnostic interface to HTTP APIs, and is the common format for describing such contracts. A good OpenAPI file lets a developer, a test tool or an AI assistant understand an API without reading the source code. In the 2025 State of the API report by Postman, 82% of organisations had adopted some level of an API-first approach, based on a survey of more than 5,700 people. Additionally, Exact Online, AFAS Profit, Mollie and Stripe all offer an API. In practice, a webshop built with Next.js can talk with all four systems.
What is the difference between API development and API integration?
API development is the work of building a new API, while API integration is the work of connecting existing APIs to each other. First, API development fits when a company owns data other systems need, for example a product catalogue for a mobile app, a partner portal for 50 companies or a frontend built with Next.js. The developer designs endpoints, authentication, versioning and documentation. Second, API integration fits when the systems already exist. A webshop, a CRM and an accounting package each offer an API, and the integration moves orders, customers and invoices between the three systems. The hard part of an integration is rarely the HTTP call itself, which usually just returns status 200. Data mapping, duplicate detection, error handling and retries take far more time. Finally, many projects in 2026 need both: an integration layer with a small API of its own, so a dashboard in Power BI from Microsoft reads one consistent source instead of five external systems.
Which types of APIs exist?
The four API styles a business meets most are REST, GraphQL, webhooks and WebSockets, and each style suits a different job. REST is the default for most web APIs: each resource has a URL, and standard HTTP methods such as GET, POST, PUT and DELETE read or change data. GraphQL lets the client ask for exactly the fields a screen needs in one request. Additionally, webhooks reverse the direction: system A calls a URL at system B as soon as an event happens, for example a paid order, and system B confirms receipt with status 200. Chat and live dashboards stay current through WebSockets, which keep a connection open. In the 2025 survey from Postman, webhooks reached 50% and WebSockets 35%. Older enterprise systems still use SOAP with XML messages. In practice, one integration often combines styles: a payment webhook from Mollie triggers a REST call to Exact Online, which then creates the invoice. Consistent naming, clear errors and documentation matter more than the style.
How do you connect accounting or ERP software such as Exact Online or AFAS?
Connecting Exact Online or AFAS Profit is a matter of reading the vendor documentation closely, because each system has its own rules. Exact Online offers a REST API in which almost every resource URI requires a Division parameter, the administration within the account. Most endpoints return 60 records per page, according to Exact, while bulk and sync endpoints return up to 1,000. For example, reading 3,000 customers takes 50 calls on a standard endpoint and only 3 on a sync endpoint. Exact therefore recommends the sync endpoints where possible. AFAS Profit works with connectors instead: a GetConnector reads data, and an UpdateConnector writes data. Each connector must first be activated in the App connector, and every call needs an environment ID and a token. In 2026, a reliable integration also logs every call, retries temporary errors and detects duplicates, so an order never becomes two invoices. VirtuoLab builds integrations with Node.js, TypeScript and PostgreSQL, which stores the logs and the sync state.
How do you keep an API secure?
A secure API is an API which checks for every request who the caller is and which data the caller may see. Broken object level authorization is risk number 1 in the API Security Top 10, published by OWASP in 2023. For example, an endpoint accepts an ID and returns the object without checking ownership. The general OWASP Top 10:2025 confirms the pattern: broken access control ranks first and appeared in 100% of the tested applications. First, authentication should use a proven standard. OAuth 2.0, defined in RFC 6749, lets an application obtain limited access to an HTTP service without sharing passwords. Second, every endpoint validates input and checks rights per object, not only per user, for instance using Node.js middleware. Third, rate limiting protects the API and the budget. RFC 6585 defines status code 429 Too Many Requests for exactly this situation, optionally with a Retry-After header. Finally, secrets belong in environment variables or a vault, never in source code.
What does API development cost?
API development at VirtuoLab costs between €1,500 and €30,000 in 2026, depending on the type of work. A simple integration between two systems with good documentation sits at €1,500 to €4,000. For example, webshop orders sent to Exact Online in one direction fit the simple tier. A custom REST API with authentication, documentation and tests sits at €5,000 to €15,000. A complex integration layer, which connects several systems with queues, monitoring and an API of its own, sits at €15,000 to €30,000. All amounts are indications, and the exact fixed price follows after a free intake call. Documentation quality is a real cost driver. According to Postman, 55% of respondents struggle with inconsistent documentation, and every unclear field adds testing time. Additionally, data volume, real-time requirements and the number of systems move the price. VirtuoLab builds every integration in-house with Node.js and TypeScript, so the client talks directly with the developer. After delivery, the client owns the source code and the data.
Frequently asked questions
Should you choose REST or GraphQL?
REST is the better default for most business APIs, and GraphQL is the better choice when one screen needs data from many related objects. Adoption reflects the difference: in the 2025 survey from Postman, 93% of respondents used REST and 33% used GraphQL. First, REST uses one URL per resource and standard HTTP caching. The result is an API which is simple to build, test and monitor. Second, GraphQL uses one endpoint and a strong type system, and the client asks for exactly the fields a screen needs. For example, a mobile app showing an order with customer, products and delivery status can fetch everything in one GraphQL query instead of four REST calls. GraphQL adds work on the server, though: query depth limits, cost limits and caching need extra attention. According to OWASP, unrestricted resource consumption is API risk number 4. In practice, a REST API documented with OpenAPI keeps a project lean, and GraphQL can follow when the frontend clearly benefits.
What happens when an external API changes?
When an external API changes, an integration can break silently, so versioning and monitoring belong in every serious integration. The timing of a vendor change is never under your control. Only 60% of respondents to the 2025 survey version their APIs, according to Postman, and 17% use no monitoring tools at all. First, an integration should pin the API version wherever the vendor allows version pinning. Second, automated tests should run against a sandbox or a test administration. Third, monitoring should alert on rising error rates, for example a sudden rise in responses with status 500. Finally, a maintenance arrangement makes sure someone reacts within days rather than weeks. A link with Exact Online or AFAS Profit deserves a check of the vendor release notes 4 times per year. In practice, such a check takes far less time than repairing a week of orders missing from the accounts.
Is a no-code tool such as Zapier enough?
A no-code tool such as Zapier or Make is enough for simple, low-volume flows, and a custom integration is the better choice once volume, logic or privacy requirements grow. No-code tools connect popular apps quickly and need no developer for a first version. For example, sending a new form entry from Google Forms to a CRM is a typical no-code job. Limits appear in three places. First, complex data mapping, such as ledger accounts, cost centres or product variants, becomes hard to maintain in a visual editor. Second, usage-based pricing grows with the number of tasks: a flow which runs 500 times per day reaches a monthly task count of 15,000. Third, data passes through a third-party platform, which matters under the GDPR. A custom integration built with Node.js runs on infrastructure the company chooses, logs every step and belongs to the company. In practice, a no-code prototype is a fine way to test a flow before investing in a custom link.