Do APIs need to hash data or is that done before/after the API call?

I am creating an API for a class this semester and I know that all of the data we are storing we need to hash for security reasons. I was wondering if the hashing was done by the API?