A public API is a software interface exposed for external access so other programs can request data or trigger limited actions in a controlled way. APIs are common in web services, mobile apps, and automation because they let systems exchange information without exposing the full internal application.
In security, public APIs matter because they are often reachable from the internet and become a target for enumeration, abuse, and authorization testing. Attackers may probe endpoints, try weak parameters, or look for missing access checks, rate limits, and input validation. In agentic systems, an automated browser or tool using a public API can also escalate from normal retrieval into repeated retries or boundary testing if permissions are too broad. Defenders reduce risk with strong authentication, read-only scopes where possible, careful logging, and strict controls on what automated clients are allowed to do.