A witness node is operated by... a witness. The node sign blocks and is usually not accessible to the outside world for obvious security reasons.
Witnesses are paid by the blockchain to run their nodes and secure the network.
An API node is operated by anyone who wants to help the community. They are usually public and are accessible to anyone.
They allow apps (including front-ends, which are apps) :
- to retrieve and use data from the blockchain
- to broadcast transactions to the blockchain
API operators are not paid for their work, which in a way is absurd because the cost and skills required to run a public API node are much higher than to run a witness node.
This can bring some issues if no one wants to run such a node. Do you remember the time when the onlySteemAPI node left was operated bySteemit and they could therefore censor the content of the blockchain?