What is a web application firewall (WAF), and what distinguishes a WAAP from an older WAF?

Question

Accepted Answer

A WAF is an application level firewall that protects web applications; it is the most common kind, specialised for HTTP. Older models could usually protect only websites, newer ones also web APIs, and modern products that do both are called "Web Application and API Protection" (WAAP).

* A WAAP sits in front of both the website and the web API and filters requests to each. *
The distinction matters because the two kinds of traffic look different. A website is used by browsers: HTML forms, cookies, page requests. A web API is used by programs: JSON or XML bodies, tokens, many calls per second, and attack patterns of its own (for example, accessing objects that belong to another user by changing an ID). A WAF built for web pages may let malicious API calls through simply because it does not parse them. A WAAP inspects both.
Go deeper:

OWASP API Security Top 10 — the API-specific risks that pushed WAFs to grow into WAAPs.
 Reverse proxy — Wikipedia — the building block a WAF sits on, in front of the web servers.