Drupal includes a REST API in core through the REST module. Once enabled, it exposes content entities as JSON over HTTP, letting external applications read and write data.
Configure which entities are exposed, which methods are supported, and which authentication mechanisms to use. Drupal supports cookie, basic auth, and OAuth through contrib modules.
For more advanced API needs, the JSON:API module, also in core, provides a standards based API following the jsonapi.org specification. It handles filtering, sorting, pagination, and relationships automatically. For GraphQL, there is a contrib module that provides a full GraphQL schema for Drupal content. Which API you choose depends on your client’s needs. JSON:API is the recommended default for most projects because it is in core and covers the majority of use cases well.