The current REST API lets you create, read, and update contacts and companies, apply or remove tags, set custom field values, pull and create orders, and work with pipeline opportunities and their stages. Authentication runs through OAuth 2.0, so an integration has to request specific scopes and get a user's approval rather than getting blanket access to the account.
Webhooks are part of the picture too: you can subscribe to events like a contact being added, a tag getting applied, or an order being placed, and have Keap push that event to your system the moment it happens instead of polling the API on a timer and hoping nothing slipped through.
If your Keap account has been around since its Infusionsoft days, some of what you'll find in older developer forums and documentation still refers to the earlier API style that account was originally built against. We check which API generation an account is actually running on before building anything, rather than assuming every Keap account looks the same underneath.