You turn it on under Advanced Parameters > Webservice in the back office, generate an API key, and then assign that key permission to specific resources (orders, products, customers, stock_availables, and dozens more) with separate read, write, update, and delete rights for each one. Nothing is exposed by default; you grant access resource by resource.
Once it's enabled, the API speaks in a REST-ish style over HTTPS, returning XML by default (JSON is supported too on newer versions if you ask for it in the request headers). A request against the orders resource, for instance, gets you order status, line items, and customer references you can pull into another system without opening the admin panel at all.
The gap shows up in configuration and version differences rather than the core resources. Some back-office settings, a handful of module-specific options, and certain store-level configuration screens were never built into the Webservice schema, and that gap is wider on older 1.6 installs than on 1.7 or 1.8. When a setting genuinely isn't reachable through the API, we handle it with scripted browser automation against the admin panel itself instead of waiting for PrestaShop to expose it.