APIs as an Architectural Decision

APIs connect CMS, CRM, ERP, and specialized systems into a single platform. Those who plan them strategically build systems that share data in real time—without duplicate maintenance, without media breaks, and without dependency on a single service provider.

What distinguishes an API from a plugin

An API (Application Programming Interface) is a defined interface between two systems. It determines which data is exchanged in which format and which operations are permitted. In a platform context, an API is not a technical add-on, but an architectural decision—it determines how autonomously a company can control its data.

An API is not a plugin. A plugin extends a system with functions. An API connects systems so that data can flow between them—in both directions, in real time or in cycles, with clear rules. Choosing to integrate an API into the platform is a decision against isolated solutions and in favor of an architecture where data is created where it is managed and used where it has an impact.

In Data Enablement, the API is the operational lever—it belongs to the Foundation Layer, the data foundation on which analysis, dashboards, and AI applications are built. Data models and reports only work if the source systems release their data—and they do so via APIs.

How APIs exchange data between
systems

API integrations follow a manageable number of architectural patterns. Those who know the patterns can justify architectural decisions instead of being talked into something by a service provider.

REST, GraphQL, Webhooks
Three construction methods for different use cases

REST

REST (Representational State Transfer) is the standard for most business integrations. The system actively retrieves data—such as real estate objects from a CRM. REST is robust, well-documented, and supported by almost every system—ensuring data is maintained where it originates, not twice.

GraphQL

GraphQL is the answer to the problem that REST often delivers too much or too little data. With GraphQL, the requesting system describes exactly which fields it needs—this saves bandwidth and complexity, but is only worthwhile for larger data volumes or complex frontends. This prevents interfaces from becoming slow due to unnecessary data volumes.

Webhooks

Webhooks reverse the direction: instead of actively querying, a system waits to be informed by the source system—for example, when a new object is created in the CRM. Webhooks are the prerequisite for true real-time integration—so that your platform doesn’t ask for updates 50 times per hour, but is informed automatically.

Access and decision:
two separate questions

API security works through clearly regulated access procedures: OAuth 2.0 (Open Authorization) for third-party integrations, API keys for machine access, and token-based procedures for personal logins. Every architectural decision is also a security decision—and is difficult to repair after the fact.

Synchronous or asynchronous – real-time is not always the answer

Synchronous API calls wait for the response—useful when the result is needed immediately (vehicle search, availability check). Asynchronous processing runs in the background—correct for mass data, imports, and reports. Most platform problems arise when these two patterns are confused.

Data format: JSON is the standard, XML still lives in legacy worlds

JSON (JavaScript Object Notation) is the standard format for modern APIs—compact, easy to read, and understood by every programming language. XML (eXtensible Markup Language) is still found in older systems, such as banking interfaces or government APIs. By relying on JSON, you build on a language that the web speaks.

Why API strategy affects all decision-makers simultaneously

API decisions are often made at the developer level and ultimately affect the entire company. Involving IT, marketing, and management early on avoids expensive corrections after launch.

Architecture, Security, Maintainability

APIs are the predetermined breaking points of every platform. At “KAMPMEYER“, the onOffice REST API determines whether 100% editorial control is possible—if a new object comes in, it is on the website without manual intervention. IT management asks: Which authentication is used? Who maintains the interface after go-live? What happens when the source system changes API versions? If you don’t have answers here, you build up maintenance effort that later becomes a cost trap.

Data Consistency and Campaign Readiness

If the CRM does not speak to the CMS, content must be maintained twice—property data in onOffice and again on the website, location data in the internal system and again in WordPress. APIs solve exactly this problem: data is maintained once and displayed everywhere. This allows the marketing team to start campaigns without waiting for manual synchronization.

Sovereignty, Growth, Investment Protection

Poor API architecture creates lock-in: the company cannot change service providers because the data is no longer separable. Good API architecture creates the opposite—digital sovereignty. Management can swap systems, map growth, and connect new locations without rebuilding the platform every time.

Our Stance on API Architecture

APIs are the predetermined breaking point of every platform. Those who think of them strategically build sovereignty. Those who treat them as a technicality build dependency. This sounds like a matter of course—but in practice, it rarely is.

In our projects since 2012, we see the same pattern over and over again: an agency has “built an API,” but no one knows which fields are synchronized, who manages the authentication, or what happens during a version change. The API is there—but it is not documented, not modeled, and not controllable. That is not an API integration; that is a data line without an architectural concept.

We treat APIs as an architectural decision, not a plugin question. Specifically, this means: before we build an interface, we model the data flow—which fields, in which direction, with what frequency, and with what error logic. Only then is it programmed.

The common pattern:
We don’t build APIs for the launch, but for the ten years that follow.

Where APIs take effect in your data architecture

API integrations are the connecting element in Data Enablement. They make the other services possible in the first place—without an API, there is no data modeling, no dashboards, and no analysis.

If you want to structure your CRM architecture

The “CRM Data Architecture” service models data flows between CRM, CMS, and specialized systems. APIs are the operational implementation there—we answer the question “which API” after the question “which data” has been answered.

If you want to analyze data centrally

The “BigQuery Setup” service brings data from various source systems into a central warehouse. Here, too, APIs are the prerequisite—without clearly defined interfaces, even the best warehouse runs empty.

Frequently Asked Questions about API Integrations

What is the difference between REST and GraphQL?

REST is the older, more prevalent architectural pattern: The requesting system calls a URL and receives a predefined dataset. GraphQL allows the requesting system to define precisely the fields it needs – this reduces data volume and complexity for large frontends. For most business integrations, REST is the appropriate choice; GraphQL is worthwhile when data volumes or frontend complexity exceed REST’s limitations.

How long does a typical API integration take?

That depends on the complexity of the data model, not on the number of fields. A standardized REST API with clear documentation (onOffice, HubSpot, Salesforce) can typically be connected for production use within 2–4 weeks once the data modeling is in place. With non-standard source systems—such as internal CRMs or legacy ERPs—the modeling alone can take several weeks, because it first has to be clarified which fields exist at all and how they relate to each other.

What happens if the connected system fails?

A resilient API integration accounts for outages. Cache layers retain the last valid data, fallback strategies display meaningful content instead of error messages, and monitoring reports the problem to IT before the user notices it. Platforms built without these mechanisms visibly collapse at the first failure of the source system – a typical symptom of integrations built without an architectural concept.

Who is responsible for the API after go-live?

This question belongs in the contract, not in the final sprint retrospective. We recommend shared responsibility: The source system (CRM, ERP) is responsible for the API version and data quality; the platform side is responsible for cache, fallbacks, and monitoring. Both sides document their agreements—version changes, breaking changes, maintenance windows. Clear regulations determine whether it is later about content or about questions of blame.

How is the GDPR regulated for API integrations?

Personal data is also subject to the GDPR within an API integration. Specifically, this means: documented data flows, clear purpose limitation, technical and organisational measures such as TLS encryption (Transport Layer Security), access restrictions and logging, as well as data processing agreements with the source system provider. For cloud APIs outside the EU, the question of Standard Contractual Clauses is added. If you do this properly, there will be no surprises in the GDPR audit.

Clarify AI roadmap in 4–6 weeks

Are you planning a platform architecture in which several systems should work together, and you don’t yet know which APIs need to be built in which order? We clarify scope, architecture, and data flows in 4–6 weeks—before a single line of code is written.

Hans Mengler

Ready to put your data to work?