Talking to APIs Without Writing Code

Most of what you want to connect does not have an MCP server yet, and may never have one. For everything else there is the API.

An API is just a URL you send a request to, which sends data back. That is the whole concept. The reason it feels intimidating is the vocabulary, so here is the vocabulary.

---

1. The five things in any API call

Every request, in every tool, is these five things.

Part	What it is	Example
Method	What kind of action	GET (read), POST (create), PUT/PATCH (update), DELETE
URL	What you are asking about	https://api.example.com/v1/customers/42
Headers	Who you are, and what format	Authorization: Bearer abc123
Body	The data you are sending	{"name": "Priya", "email": "..."}
Response	What comes back	{"id": 42, "status": "created"}

GET requests usually have no body. POST requests usually do.

---

2. Reading API documentation

Every API's docs answer the same four questions. Find those and ignore the rest.

1. What is the base URL? Everything hangs off it.
2. How do I authenticate? Almost always a key in a header.
3. What endpoints exist? The list of things you can ask for.
4. What does it return? So you know what to expect.

Most docs have a "Quickstart" that answers all four in one page. Start there, not at the reference.

---

3. Test before you build

Do not debug an API inside an automation. You will not be able to tell whether the problem is the API, your credentials, or your workflow.

Test the call on its own first — in an API client, or in a single-step workflow that does nothing but the request. When it returns what you expect, then put it into the automation.

A minimal test:

Method:  GET
URL:     https://api.example.com/v1/customers
Headers: Authorization: Bearer YOUR_KEY
         Accept: application/json

Send it. You want a 200 and some data. Anything else, see the table below.

---

4. The status codes you will actually meet

Code	Means	Usually
200 / 201	Worked	—
400	Bad request	Your body is malformed, or a required field is missing
401	Unauthorised	Key is wrong, missing, or not in the header it expects
403	Forbidden	Key is valid but lacks permission for this
404	Not found	Wrong URL, or the thing genuinely does not exist
422	Unprocessable	Right shape, invalid values
429	Too many requests	Rate limited — slow down
500 / 502 / 503	Their problem	Retry with a delay

401 and 403 look similar and are not. 401 means "I don't know who you are"; 403 means "I know, and no".

---

5. Putting it in an automation

Every platform has a generic HTTP node. Once your call works in testing, it transfers directly.

HTTP Request node
  Method:  POST
  URL:     https://api.example.com/v1/tickets
  Headers: Authorization: Bearer {{credential}}
           Content-Type: application/json
  Body:    {
             "subject": "{{trigger.subject}}",
             "body": "{{ai_summary}}",
             "priority": "{{ai_urgency}}"
           }

Use the platform's credential store, not a header typed into the node. Credentials in a node are visible to anyone who can see the workflow, and they end up in exports and screenshots.

---

6. Reading the response

An API returns JSON — nested data. You need the one value you care about.

{
  "data": {
    "customer": {
      "id": 42,
      "orders": [
        { "id": 1001, "status": "shipped" }
      ]
    }
  }
}

The path to the order status is data.customer.orders[0].status. Most platforms let you click the value in a test result and insert the path automatically — do that rather than typing it.

Always run a test and look at the actual response before mapping fields. Documentation is frequently out of date about response shape.

---

7. When there is no API

Some things you want data from simply do not offer one.

Scraping services provide pre-built extractors for common sites, returning clean structured data you can feed into a workflow. This is the practical route for a non-coder.

Before you scrape anything:

• Check the terms of service. Many sites prohibit it, and some enforce.
• Check for an official API first. It is almost always more stable.
• Respect rate limits. Aggressive scraping gets your IP blocked and can constitute a denial of service.
• Do not scrape personal data and feed it into AI without a lawful basis. This is a data protection question, not a technical one.
• Expect it to break. Sites change their markup. Scraping is inherently fragile in a way APIs are not.

---

8. Protecting your keys

An API key is a password that can spend your money.

• Never paste a key into a chat assistant, a screenshot, or a document
• Store keys in your platform's credential store
• Use a separate key per integration, so you can revoke one without breaking everything
• Set a spending cap at the provider where possible
• Rotate any key that has ever been exposed — assume exposed means public
• Never commit a key anywhere it could be shared

If you think a key leaked, rotate it immediately. Do not investigate first.

---

9. Rate limits and retries

APIs limit how often you can call them. Exceed it and you get 429.

On 429 or 5xx:
  wait 2 seconds, retry
  wait 4 seconds, retry
  wait 8 seconds, retry
  then stop and alert a human

Increasing delays, capped at three attempts. Never retry immediately in a loop — against a rate limit that makes the problem worse and can get you blocked entirely.

Do not retry 400, 401, 403 or 404. Those will fail identically every time; they need a fix, not a retry.

---

⚠️ Common Mistakes

• Debugging inside the automation. Test the call in isolation first.
• Credentials typed into the node. Use the credential store.
• Mapping fields from the documentation rather than from an actual test response.
• Retrying a 401. It will fail the same way forever.
• Immediate retries on 429. Makes it worse; can get you blocked.
• No timeout. A hung request holds the workflow open indefinitely.
• Ignoring pagination. The API returned 100 results and there are 4,000. Check for a next field.
• Assuming the response shape. Run a test and look.

---

What's Next: You can connect to anything. The last piece is putting it in front of people — an assistant in the messaging app they already use.