The SAP API Business Hub catalogs prebuilt APIs across SAP's products, S/4HANA, SuccessFactors, Ariba, and more, mostly built on OData, which exposes business objects as queryable, filterable REST-style endpoints. That catalog is a genuinely useful starting point for seeing what's technically possible before anyone writes a line of code.
Older ECC systems that haven't been fully modernized onto OData often still rely on RFC and BAPI calls instead, the older function-call interface SAP's always supported, or IDocs for document-based exchanges like orders and invoices. Which one you're actually working against depends on the SAP version and how much of it has been upgraded, not just which API the documentation happens to describe.
Authentication adds its own layer on top: OAuth 2.0 for cloud-facing OData services, and for on-premise systems, SAP Cloud Connector to bridge a request from outside the network into SAP without opening the whole system to the internet.