Where are you stuck? The idea would be to have a script which goes through all the distinct names, requests data on them from Behind the Name using its API (see the requests package for how to make API requests), and stores them somehow (you could make a JSON file, or an SQLite DB, whatever...). More on reddit.com

You are right about this problem though. The best solution that I have found for it is to make it 100% automated by the HR system. Twice a day there was a data extract from the HR system that pulled enough information to determine if the employee or person was active with the company. When an employee left, the HR system would be maintained (because payroll). The process would detect the change and disable the account. This also worked for new employees. Once HR got them to a certain status in the system, an account would be generated. (This was after the acceptable computer use policy (all paperwork) was signed and turned in). HR would get an email with the account name and instructions on the password. It was some pattern like, 2 digit day of birth, plus first and last initials, plus first 4 of social security number. I would detect the auto generated account and add basic group membership and provision default folders. HR was in 100% control of all non-service accounts. This sounds scary and impossible, but after the initial pain of the new process (and it will be painful), it was a dream come true. We were only in the loop for when people got fired after that. The real pain was all the departments that would hire someone and tell us after they started. "Hey IT, Bob just started the other day. I am going to hover over you while you create him an account." After years of bending the system for them, they didn't take it so well when it all stopped. "We don't do that any more. If you got all the HR stuff taken care of then an account would auto-generated and HR will have that info for you". Sorry for my rant. I just had flashbacks to when I had to deal with this stuff. More on reddit.com

Generally, an API defines the public facing gateway to interact with a system. This can be a website, this can be some REST API, this can be a programming language. When you come across API in documentation it generally means the classes, methods, functions, and data that you, as the programmer/user are supposed to use to interact with the site/API/Language. More on reddit.com

The answer is a bit more complex. It depends on what kind of structure you have. When you have CSR code that fetches data from the api to render content, the endpoints must be hardcoded into the client side javascript for the fetch. If you serve those from your server, things like content security policy and no cors can make the api call work only if the origin is the same (get client code from your server origin, fetch api from this origin to same origin api). if you serve the frontend code from like a cdn which makes the call to your server providing the API, you can whitelist with CSP and CORS basically your frontend code only. The server is the one that handles the authorization/authentication/security in any case. from where is the req coming? is it authorized? does it have to be authenticated? is it CORS? does it have the permissions to perform the req? you can "hide" client side code by serving static files behind a route that requires a login. For example: a cdn hosts your landing page, but you don't want to serve the dashboard logged in page to everyone. The login button in this page will point to a route in your server which authenticates the user and redirects it to another endpoint in your server which verifies the authenticated user and if successful serves the dashboard react code (which will contain the api routes to your server that will fetch the db and populate fields). At this point, the api routes will be visible. If you instead serve the whole react code up front from the cdn (landing + dashboard), the routes from the api that you need the client to use need to be hardcoded into it but if the request is not authorized (verified by server) it will redirect to the login page instead. Another solution is SSR, client browser makes a request to a endpoint on your server and it handles everything. It will verify the request, fetch the data needed from your api behind closed doors, create the HTML with the personalized data and serve the html + css + eventual JS (using something like express.static) without exposing any route apart from the /dashboard. the cons is that it can't rerender data live without another request with page refresh. to get updated data you need to refresh the page and redo the above operation and usually the html has the data hardcoded. It's probably possible to hardcode data into SSR react code too for a SPA but i still have to dive in to react. (which means hardcoding data into JS for rendering instead of plain html but the data still needs to be fetched with a page refresh) A mix of everything of the above is possible too. Please research the above better because i'm quite new to fullstack too and this is a summarized view of how it works from my understanding. Hope someone will integrate the above too. More on reddit.com