Integration inventory
each system, its API type, owner, authentication method and data volume.
CONNECTED SYSTEMS • CONSISTENT RECORDS
API Integration
Move each record reliably between your business systems.
Connect ERP, CRM, payment and SaaS platforms through secured, versioned and monitored flows—with clear owners and recovery paths.
- Mapped data flows
- Recoverable failures
- Named flow owners
THE STARTING POINT
Consistent records need an owned, observable flow.
APIs connect applications through defined endpoints and events. Mapping rules, permissions, retries and monitoring keep the connection usable when systems change.
What API integration includes
Orders typed twice, customer records that disagree and a sync job nobody can explain. API integration connects those systems so each record moves once and stays consistent.
API Integration for ERP, CRM, Payment and SaaS Systems
API integration belongs to software integration and links two or more applications through their application programming interfaces (APIs). Engineers map data between systems, call and expose REST, SOAP or GraphQL endpoints, subscribe to webhooks and retry failed calls. Connected systems include ERP platforms, CRM platforms, payment gateways and SaaS tools such as e-signature or shipping services. Each finished connection becomes a data flow: a defined path that moves records or events from a source system to a target system. Data flows keep orders, customers, invoices and inventory consistent across applications without manual re-entry.
API integration differs from file transfer and screen scraping. File transfer moves batches on a schedule. Screen scraping reads a user interface and breaks when the screen changes. AppsGlobal provides API integration services as one of its software engineering services, joining the enterprise software an organization already runs into one connected system.
01 / API INTEGRATION
Fix the failures behind mismatched records
Unowned scripts, silent errors, retired versions and exposed endpoints make connected systems unreliable.
Point-to-point connections multiply with each new system
Teams connect each new application directly to each system it needs. Five systems produce up to ten separate connections, and each one carries its own mapping and credentials. One field change in the ERP then breaks connections that nobody documented. Integration work turns into tracing which script writes which field.
Sync jobs fail without telling anyone
Scheduled scripts stop on a timeout, skip a record or post it twice after a retry. No alert reaches the business owner. Sales sees an order that finance did not invoice. Warehouse staff ship against stock levels from yesterday. Errors surface weeks later during reconciliation or a customer complaint.
Vendors retire the API versions integrations depend on
SaaS vendors deprecate old API versions and then switch them off. Integrations built years earlier keep calling the retired endpoints until the calls fail. Salesforce retired its SOAP, REST and Bulk API versions 21.0 through 30.0 in the Summer '25 release. Calls to those versions then returned errors such as HTTP 410 Gone.
Exposed APIs leak customer data
Endpoints that skip object-level authorization or rate limits return records to any caller holding a valid token. Attackers enumerate account IDs and collect data one request at a time. T-Mobile reported in a January 2023 Form 8-K that one API had been abused to obtain data from about 37 million customer accounts. Salt Labs surveyed 206 IT and security professionals in early 2025, and 99 percent reported API security issues in the prior 12 months.
Read the full explanation
Integration failures that leave enterprise systems out of sync
Enterprise systems fall out of sync through four integration failures: point-to-point sprawl, silent sync errors, retired API versions and exposed endpoints. Each failure begins as a shortcut during a past project. Each one surfaces later as wrong records, stalled orders or leaked data.
Point-to-point connections multiply with each new system
Teams connect each new application directly to each system it needs. Five systems produce up to ten separate connections, and each one carries its own mapping and credentials. One field change in the ERP then breaks connections that nobody documented. Integration work turns into tracing which script writes which field.
Sync jobs fail without telling anyone
Scheduled scripts stop on a timeout, skip a record or post it twice after a retry. No alert reaches the business owner. Sales sees an order that finance did not invoice. Warehouse staff ship against stock levels from yesterday. Errors surface weeks later during reconciliation or a customer complaint.
Vendors retire the API versions integrations depend on
SaaS vendors deprecate old API versions and then switch them off. Integrations built years earlier keep calling the retired endpoints until the calls fail. Salesforce retired its SOAP, REST and Bulk API versions 21.0 through 30.0 in the Summer '25 release. Calls to those versions then returned errors such as HTTP 410 Gone.
Exposed APIs leak customer data
Endpoints that skip object-level authorization or rate limits return records to any caller holding a valid token. Attackers enumerate account IDs and collect data one request at a time. T-Mobile reported in a January 2023 Form 8-K that one API had been abused to obtain data from about 37 million customer accounts. Salt Labs surveyed 206 IT and security professionals in early 2025, and 99 percent reported API security issues in the prior 12 months.
Each failure points to an architecture decision: a hub or gateway instead of direct links, monitored flows with idempotent writes, version tracking and authorization on each object. Those decisions start with choosing the integration pattern.
02 / API INTEGRATION
Choose how your systems connect
Compare four patterns by how data moves and when each fits. Volume, latency and ownership guide the choice.
PATTERN 1 OF 4
Point-to-point API calls
- How data moves
- One application calls another directly
- Fits when
- Two systems, one owner, low change rate
PATTERN 2 OF 4
API gateway with managed APIs
- How data moves
- Callers reach services through one governed entry point
- Fits when
- Partners and apps share internal services
PATTERN 3 OF 4
Integration platform (iPaaS) or middleware
- How data moves
- A central platform transforms and routes messages
- Fits when
- Five or more systems with shared mappings
PATTERN 4 OF 4
Event-driven messaging
- How data moves
- Systems publish events to a broker such as Kafka or a cloud queue
- Fits when
- High volume, near-real-time updates, loose coupling
Read the full explanation
Integration patterns that set how API integration scales
API integration uses four patterns, each suited to a different volume, latency and ownership model.
Integration platforms such as MuleSoft, Boomi and Azure Integration Services hold mappings in one place. Event brokers decouple senders from receivers. Slow target systems then leave the source unaffected.
| Pattern | How data moves | Fits when |
|---|---|---|
| Point-to-point API calls | One application calls another directly | Two systems, one owner, low change rate |
| API gateway with managed APIs | Callers reach services through one governed entry point | Partners and apps share internal services |
| Integration platform (iPaaS) or middleware | A central platform transforms and routes messages | Five or more systems with shared mappings |
| Event-driven messaging | Systems publish events to a broker such as Kafka or a cloud queue | High volume, near-real-time updates, loose coupling |
03 / API INTEGRATION
Six artifacts you can operate and maintain
The connection code is one part of delivery. Inventories, contracts, dashboards and runbooks make each flow understandable.
Data mapping specification
field-by-field rules, such as how CRM account status maps to ERP customer status.
API contracts
OpenAPI 3.1 or AsyncAPI documents that define each endpoint and event.
Integration services
connectors, transformations and webhook handlers with retry and dead-letter queues.
Monitoring dashboards
throughput, error rate, latency and backlog per flow, with alerts to named owners.
Runbooks
steps to replay failed messages, rotate credentials and handle vendor version changes.
Read the full explanation
What an API integration project delivers
Custom API integration produces six working artifacts beyond the connection code.
Integration inventory: each system, its API type, owner, authentication method and data volume.
Data mapping specification: field-by-field rules, such as how CRM account status maps to ERP customer status.
API contracts: OpenAPI 3.1 or AsyncAPI documents that define each endpoint and event.
Integration services: connectors, transformations and webhook handlers with retry and dead-letter queues.
Monitoring dashboards: throughput, error rate, latency and backlog per flow, with alerts to named owners.
Runbooks: steps to replay failed messages, rotate credentials and handle vendor version changes.
APIs that external partners or mobile apps call get their own developer documentation and sandbox keys.
04 / API INTEGRATION
A message can arrive late—or twice
Idempotency, controlled retries and recovery queues turn failures into visible events. Try the fictional order-flow example below.
Idempotency keys
Each write carries a unique key. Retried requests then reuse that key instead of creating a second order or payment.
Retries with exponential backoff
Failed calls retry at growing intervals and respect vendor rate limits such as HTTP 429 responses.
Dead-letter queues
Messages that fail after the retry limit move to a queue for review instead of disappearing.
Reconciliation jobs
Scheduled counts compare record totals between source and target and flag gaps.
Version tracking
Each connector records the vendor API version it calls and the vendor's announced retirement date.
FICTIONAL FLOW • BROWSER-LOCAL DEMO
One order. Repeat delivery. One target record.
Deliver the same order twice to see deduplication. Reset, turn off target availability and try three deliveries to see recovery.
SOURCECRM order
ORDER-1042→CONNECTORSame key on every attempt
order-1042→TARGETERP record writes
0
ORDER-1042→CONNECTORSame key on every attempt
order-1042→TARGETERP record writes
0
Retry limit: 3 attempts. The backoff intervals are illustrative; no timer or real API request runs.
READY TO DELIVER
Send the order to begin.
No delivery has been attempted.
Read the full explanation
Data flow reliability rules in API integration
Reliable API integration treats each message as something that can arrive late, arrive twice or fail to arrive. Five engineering rules handle those cases:
Idempotency keys. Each write carries a unique key. Retried requests then reuse that key instead of creating a second order or payment.
Retries with exponential backoff. Failed calls retry at growing intervals and respect vendor rate limits such as HTTP 429 responses.
Dead-letter queues. Messages that fail after the retry limit move to a queue for review instead of disappearing.
Reconciliation jobs. Scheduled counts compare record totals between source and target and flag gaps.
Version tracking. Each connector records the vendor API version it calls and the vendor's announced retirement date.
These rules convert silent failures into visible, recoverable events. Regression suites from software testing then confirm that mappings still hold after each vendor release.
05 / API INTEGRATION
Control the caller, the record and the traffic
Authenticate systems, authorize each record, validate schemas and manage credentials outside source code.
Authentication
OAuth 2.0 client credentials for system-to-system calls and mutual TLS for high-trust partners.
Object-level authorization
checks that each requested record belongs to the calling account.
Rate limiting and quotas
per-client limits at the gateway that stop enumeration and runaway scripts.
Secrets management
API keys and tokens stored in a vault, rotated on a schedule and kept out of source code.
Schema validation
requests and responses checked against the API contract to block unexpected fields.
Read the full explanation
API security controls for integrated systems
API integration security decides three things for each caller: endpoint access, record access and traffic volume.
Authentication: OAuth 2.0 client credentials for system-to-system calls and mutual TLS for high-trust partners.
Object-level authorization: checks that each requested record belongs to the calling account.
Rate limiting and quotas: per-client limits at the gateway that stop enumeration and runaway scripts.
Secrets management: API keys and tokens stored in a vault, rotated on a schedule and kept out of source code.
Schema validation: requests and responses checked against the API contract to block unexpected fields.
Penetration tests and API discovery scans from cybersecurity find shadow endpoints and authorization gaps before attackers do.
06 / API INTEGRATION
From inventory to monitored production
Five stages produce reviewable artifacts before cutover. Parallel runs compare the new flow with the old process.
01Discovery
Discovery. Engineers list systems, flows, owners and pain points. Flows are then ranked by business impact.
02Design
Design. Architects choose the pattern, write the data mapping and publish API contracts.
03Build in sandboxes
Build in sandboxes. Developers build connectors against vendor sandbox accounts with test data.
04Parallel run
Parallel run. New flows run beside the old process, and reconciliation reports compare results.
05Cutover and monitoring
Cutover and monitoring. Engineers switch off the old scripts. Dashboards and alerts go live with named owners.
PARALLEL RUN
Compare records before cutover.
Reconcile the new flow against the old process, then activate dashboards and alerts for its named owner.
Read the full explanation
How API integration moves from inventory to monitored production
API integration delivery runs in five stages, and each stage ends with a reviewable artifact.
Discovery. Engineers list systems, flows, owners and pain points. Flows are then ranked by business impact.
Design. Architects choose the pattern, write the data mapping and publish API contracts.
Build in sandboxes. Developers build connectors against vendor sandbox accounts with test data.
Parallel run. New flows run beside the old process, and reconciliation reports compare results.
Cutover and monitoring. Engineers switch off the old scripts. Dashboards and alerts go live with named owners.
Pipelines from DevOps deploy connector changes, and integration runtimes run on infrastructure from cloud engineering.
07 / API INTEGRATION
Scope the systems, mapping and running volume
API quality, mapping complexity, timing requirements and platform licensing shape the estimate. Measure them during discovery.
Systems and API quality
Modern APIs and vendor sandboxes shorten connector work. Legacy sources may need an adapter first.
Mapping complexity
Multi-currency pricing, bundles and transformations need specification and test coverage.
Volume and timing
Real-time or high-volume flows add event infrastructure and load testing.
Platform licensing
An iPaaS adds recurring licensing. Custom services need their own operations and maintenance.
Read the full explanation
Systems, API quality and volume behind API integration cost
API integration cost depends on the number of systems, the quality of their APIs and the data volume. Modern REST APIs with sandbox accounts shorten the build. Legacy systems without APIs need an adapter, a database connector or a modernization step first. Complex mappings, such as multi-currency pricing or product bundles, add specification and test time. High-volume or real-time flows add event infrastructure and load testing. Platform licensing for an iPaaS adds a recurring cost that custom code avoids. Discovery measures those factors before a price is set.
08 / API INTEGRATION
Connect the systems your industry runs
Every sector has a different mix of platforms. The integration still needs clear ownership, mappings and recovery rules.
Retail and e-commerce
storefront, ERP, warehouse and shipping carrier APIs for order-to-delivery flows.
Healthcare
EHR systems through HL7 FHIR APIs, plus billing and scheduling platforms.
Logistics
transportation management, carrier tracking and customer portals.
Manufacturing
ERP, manufacturing execution and supplier portals for purchase orders.
Insurance
policy administration, rating engines and claims systems.
Real estate
listing services, property management and accounting systems.
Professional services
CRM, project management, time tracking and invoicing.
Read the full explanation
API integration across industries
Each industry joins its own core systems through APIs.
Retail and e-commerce: storefront, ERP, warehouse and shipping carrier APIs for order-to-delivery flows.
Healthcare: EHR systems through HL7 FHIR APIs, plus billing and scheduling platforms.
Logistics: transportation management, carrier tracking and customer portals.
Manufacturing: ERP, manufacturing execution and supplier portals for purchase orders.
Insurance: policy administration, rating engines and claims systems.
Real estate: listing services, property management and accounting systems.
Professional services: CRM, project management, time tracking and invoicing.
09 / API INTEGRATION
Prepare the source. Reuse the connected data.
Adapters and business logic may come first. Web apps, mobile apps and AI services then use the integrated APIs.
Prepare legacy access
Software Modernization Services ↗Build missing business logic
Custom Software Development ↗Show live data in web applications
Web Development ↗Connect mobile workflows
Mobile App Development ↗Feed AI with connected records
AI Solutions and Engineering ↗Read the full explanation
What API integration needs from sibling services and what it returns
API integration connects systems. It relies on adjacent services and feeds others.
Needs from other services:
Legacy systems with no usable API go through software modernization or receive an adapter before integration.
New business logic that no existing system holds is built by custom software development.
Returns to other services:
Web development and mobile app development call the integrated APIs to show live orders, accounts and stock.
AI solutions read clean, connected records for forecasting, search and automation.
10 / API INTEGRATION
Choose who owns design, build and monitoring
Add API developers to your architecture team or outsource the full integration engagement. Four roles support the flow.
In-house architecture
Add API developers when your own architect owns integration design.
Outsourced integration
One team owns design, build and monitoring.
Remote team extension
Add integration engineers to your existing team for a set period.
Integration architect
chooses patterns, owns the data model and approves API contracts.
Integration developer
builds connectors, transformations and webhook handlers.
QA engineer
builds contract tests, mapping tests and reconciliation checks.
Platform engineer
runs the gateway, message broker and monitoring stack.
Read the full explanation
In-house API developers or an outsourced API integration team
Organizations hire API developers when an in-house architect owns the integration design. Organizations outsource API integration when they need one API integration company to own design, build and monitoring. Remote team extension adds integration engineers to an existing team for a set period.
Integration teams combine four roles:
Integration architect: chooses patterns, owns the data model and approves API contracts.
Integration developer: builds connectors, transformations and webhook handlers.
QA engineer: builds contract tests, mapping tests and reconciliation checks.
Platform engineer: runs the gateway, message broker and monitoring stack.
11 / API INTEGRATION
Plan for ownership and vendor change
Understand platform choice, client-controlled accounts and maintenance before the first connection goes live.
Is an iPaaS platform required for API integration?
No. Custom code fits two or three stable connections, and an iPaaS fits larger estates. Integration platforms add prebuilt connectors, visual mappings and central monitoring for a license fee. Custom services avoid the license and give full control over logic. Organizations with five or more connected systems and frequent mapping changes benefit from central platform mappings.
Who owns the integration code and credentials?
Clients own the integration code, API contracts and credentials when the contract assigns them. Repositories, vault entries and gateway configurations live in client-controlled accounts from the start. Integration engineers work inside those accounts with scoped access. Access is removed when the engagement ends.
How are vendor API changes handled after go-live?
Maintenance updates each connector before its vendor's retirement date. Monitoring tracks deprecation notices against connector versions. Vendors such as Salesforce and Shopify publish API version schedules. Contract tests run against new versions in sandboxes first. Updated connectors then deploy through the same pipeline as other code changes.
12 / API INTEGRATION
Map your integrations before the next sync failure
Bring the systems and troublesome flows. Start with an integration map showing patterns, owners, versions and failure risks.
Make every connection understandable.
- Source and target systems for each flow
- Its pattern, owner and API version
- Failure risks and priorities for the first fixes
Read the full explanation
Map your integrations before the next sync failure
List the systems your teams copy data between and the flows that fail. AppsGlobal turns that list into an integration map. Each connection on the map shows its pattern, owner, API version and failure risk. You then decide which flows API integration fixes first.