I'm building a web application that has a feature which allows visitors to directly access resources using URL patterns, for example:
These URLs can be static or dynamic links from other applications/sites. The URLs are secured, but if header of the HTTP request contains the authentication token (e.g. the visitor was logged into the previous site), then the authentication process is invisible to the visitor.
My question is, is it correct to describe this feature as an API? Why or why not? My instinct is no, because the request is received by and returned in the browser. Also, the system as it would not accept a request that did not have that auth token in the header.
My colleagues refer to this as an API, and I'm having trouble explaining why this feature doesn't fit the definition of an API (and what it should be called instead).